@h-ai/deploy 0.1.0-alpha.67 → 0.1.0-alpha.68

package/dist/index.js

@@ -1,13 +1,15 @@
-import { createHash, randomBytes } from 'crypto';
+import { createHash, randomBytes, randomUUID } from 'crypto';
 import { createReadStream, readFileSync, existsSync, lstatSync, writeFileSync, chmodSync, mkdirSync, mkdtempSync, copyFileSync, renameSync, rmSync, statSync, readdirSync } from 'fs';
 import { resolve, join, basename, dirname, relative, sep } from 'path';
 import { z } from 'zod';
 import { core, err, ok } from '@h-ai/core';
-import process2 from 'process';
+import process3 from 'process';
 import { parseEnv } from 'util';
 import { LineCounter, parseDocument, parse, stringify, parseAllDocuments } from 'yaml';
 import { homedir } from 'os';
 import { spawn } from 'child_process';
+import { readdir, readFile } from 'fs/promises';
+import { setTimeout as setTimeout$1 } from 'timers/promises';
 import { Buffer } from 'buffer';
 
 // src/deploy-artifact.ts
@@ -109,8 +111,17 @@ var en_US_default = {
   deploy_webProxyInvalid: "The API prefix must be an absolute path containing only letters, numbers, underscores, hyphens and slashes.",
   deploy_artifactInvalid: "Image artifacts are missing or invalid. Run pnpm build --target docker, select valid --artifact-dir, or use pnpm run deploy --build.",
   deploy_sshRequired: "Automatic deployment requires SSH settings. Use --bundle-only for manual transfer when the server is unreachable.",
-  deploy_bundleInstructions: "Bundle: {file}\nIncludes all images needed by selected services, including self-hosted middleware.\nWith SSH access, run deploy.ps1 (Windows) or deploy.sh (Linux/macOS) from the adjacent deployment directory.\nFor isolated servers, copy and extract the tar into a separate directory, then run sh apply.sh /opt/hai/apps/project-environment.\nLinux requires Docker/Podman, Compose, sh, tar, sha256sum, awk, curl and filesystem/container permissions.\nPartial updates require a successful full installation with matching ports/layout. Steps return nonzero on failure; result-DEPLOYMENT_ID.json records the outcome.\nThe bundle contains private runtime configuration; transfer it securely.\nIncluded images:\n{images}",
+  deploy_bundleInstructions: "Bundle: {file}\nIncludes all images needed by selected services, including self-hosted middleware.\nWith SSH access, first edit deploy-target.json in the adjacent deployment directory using its _comments, then run deploy.ps1 (Windows) or deploy.sh (Linux/macOS) there. Both read this JSON; the sh entry also requires local awk.\nFor isolated servers, copy and extract the tar into a separate directory, then run sh apply.sh (uses the configured target directory).\nLinux requires Docker/Podman, Compose, sh, tar, sha256sum, awk, curl, util-linux flock and filesystem/container permissions on a filesystem supporting flock.\nNever delete or replace .deploy.lock; its lock releases after every holder exits or the server restarts. Inspect execution and recovery state after forced termination.\nPartial updates require a successful full installation with matching ports/layout. Steps return nonzero on failure; result-DEPLOYMENT_ID.json records the outcome.\nThe bundle contains private runtime configuration; transfer it securely.\nIncluded images:\n{images}",
   deploy_bundleMetadata: "Application version: {version}\nBuild ID: {buildId}\nCompose file: {compose}",
+  deploy_targetHost: "Required: Linux server address or SSH alias. Replace SERVER_HOST before running either upload script.",
+  deploy_targetPort: "SSH port, integer 1-65535; default 22.",
+  deploy_targetUsername: "SSH login username; default deploy. Requires write access to directory and container runtime permissions.",
+  deploy_targetIdentityFile: "Optional private key path on the computer running the upload script. Prefer an absolute path; empty uses ssh-agent/default keys. HAI_DEPLOY_IDENTITY_FILE overrides it.",
+  deploy_targetKnownHostsFile: "Optional known_hosts path on the computer running the upload script. Prefer an absolute path; empty uses OpenSSH defaults. HAI_DEPLOY_KNOWN_HOSTS_FILE overrides it.",
+  deploy_targetStrictHostKeyChecking: "Boolean, default true: trust new host keys and reject changed keys. false disables host key checking.",
+  deploy_targetConnectTimeoutSeconds: "SSH connection timeout in seconds, integer 1-2147483647; default 10.",
+  deploy_targetDirectory: "Required absolute application directory on the Linux server; contains incoming packages, releases and successful current state. Parent-directory traversal is forbidden.",
+  deploy_targetBundle: "Required tar filename in the parent of this deployment directory. Keep the tar and this entire directory together when moving them.",
   deploy_bundleOnlyContainer: "Compose bundle generation is supported only by docker-ssh.",
   deploy_selectedContainerOnly: "Selected-service deployment requires a docker-ssh Compose destination.",
   deploy_selectionInvalid: "Cannot deploy {service}: check the service name and build its image first.",
@@ -121,7 +132,102 @@ var en_US_default = {
   deploy_configFileUnreadable: "Cannot read configuration file {path}. Check its path and permissions.",
   deploy_bundleNameInvalid: "Bundle filenames may contain letters, numbers, dots, plus signs, hyphens and underscores; parent directories may contain spaces.",
   deploy_secretsInvalid: "Middleware credentials are damaged or incomplete: {path}. Restore a backup; passwords are not regenerated because existing data may become inaccessible.",
-  deploy_storageArtifactRequired: "Storage initialization requires the application image. Select a complete artifact containing app with --artifact-dir, or run pnpm build --target docker --images app first."
+  deploy_storageArtifactRequired: "Storage initialization requires the application image. Select a complete artifact containing app with --artifact-dir, or run pnpm build --target docker --images app first.",
+  deploy_localStopped: "The local command process tree has been confirmed exited.",
+  deploy_localUnknown: "Local process tree termination is unconfirmed; inspect local execution state.",
+  deploy_localNotStarted: "The local command was not started.",
+  deploy_commandOutputFailed: "Command output or callback failed",
+  deploy_commandInputFailed: "Command input failed",
+  deploy_commandTreeActive: "Child processes remain active after the main command exited",
+  deploy_commandExecutionFailed: "Command execution failed",
+  deploy_remoteUnknown: "Remote execution is unknown. Local SSH termination does not prove remote deployment stopped; inspect the server result and actual containers.",
+  deploy_remoteFinished: "A matching server result confirms the deployment script and recovery finished: stage {stage}, exit {code}. Verify actual service health."
+};
+
+// messages/ja-JP.json
+var ja_JP_default = {
+  deploy_notInitialized: "\u30C7\u30D7\u30ED\u30A4\u30E2\u30B8\u30E5\u30FC\u30EB\u304C\u521D\u671F\u5316\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u5148\u306Bdeploy.init()\u3092\u547C\u3073\u51FA\u3057\u3066\u304F\u3060\u3055\u3044",
+  deploy_initFailed: "\u30C7\u30D7\u30ED\u30A4\u30E2\u30B8\u30E5\u30FC\u30EB\u306E\u521D\u671F\u5316\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_unsupportedProviderType: "\u672A\u5BFE\u5FDC\u306E\u30C7\u30D7\u30ED\u30A4\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u306E\u7A2E\u985E\u3067\u3059: {type}",
+  deploy_unsupportedProvisionerType: "\u672A\u5BFE\u5FDC\u306E\u30B5\u30FC\u30D3\u30B9\u30D7\u30ED\u30D3\u30B8\u30E7\u30CA\u30FC\u306E\u7A2E\u985E\u3067\u3059: {type}",
+  deploy_configTokenRequired: "\u30C7\u30D7\u30ED\u30A4\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u306E\u30C8\u30FC\u30AF\u30F3\u306F\u5FC5\u9808\u3067\u3059",
+  deploy_authRequired: "\u8A8D\u8A3C\u304C\u5FC5\u8981\u3067\u3059",
+  deploy_authFailed: "\u8A8D\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_projectCreateFailed: "\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_uploadFailed: "\u30D3\u30EB\u30C9\u6210\u679C\u7269\u306E\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_deployFailed: "\u30C7\u30D7\u30ED\u30A4\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_provisionFailed: "\u30B5\u30FC\u30D3\u30B9\u306E\u6E96\u5099\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {service} - {error}",
+  deploy_adapterMissing: "\u5BFE\u8C61\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u306E\u30A2\u30C0\u30D7\u30BF\u30FC\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002{adapter}\u3092\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u3057\u3066\u304F\u3060\u3055\u3044",
+  deploy_scanFailed: "\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u306E\u30B9\u30AD\u30E3\u30F3\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_envVarFailed: "\u74B0\u5883\u5909\u6570\u306E\u8A2D\u5B9A\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_credentialError: "\u8A8D\u8A3C\u60C5\u5831\u306E\u8AAD\u307F\u66F8\u304D\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_credentialInvalidKey: "\u672A\u5BFE\u5FDC\u306E\u8A8D\u8A3C\u60C5\u5831\u30AD\u30FC\u3067\u3059: {key}\u3002HAI_DEPLOY_*\u30AD\u30FC\u306E\u307F\u4F7F\u7528\u3067\u304D\u307E\u3059",
+  deploy_credentialSaved: "\u8A8D\u8A3C\u60C5\u5831\u3092\u4FDD\u5B58\u3057\u307E\u3057\u305F",
+  deploy_credentialLoaded: "\u8A8D\u8A3C\u60C5\u5831\u3092\u8AAD\u307F\u8FBC\u307F\u307E\u3057\u305F",
+  deploy_configError: "\u30C7\u30D7\u30ED\u30A4\u8A2D\u5B9A\u30A8\u30E9\u30FC: {error}",
+  deploy_credentialMissing: "\u8A8D\u8A3C\u60C5\u5831\u306E\u9805\u76EE\u304C\u4E0D\u8DB3\u3057\u3066\u3044\u307E\u3059: {fields}",
+  deploy_apiError: "{service} API\u30A8\u30E9\u30FC\uFF08{status}\uFF09",
+  deploy_fileUploadFailed: "\u30D5\u30A1\u30A4\u30EB\u306E\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u306B\u5931\u6557\u3057\u307E\u3057\u305F\uFF08{status}\uFF09",
+  deploy_provisionNoResult: "{service}\u304B\u3089\u63A5\u7D9A\u60C5\u5831\u304C\u8FD4\u3055\u308C\u307E\u305B\u3093\u3067\u3057\u305F",
+  deploy_recoveryFailure: "{stage}\u3067\u30C7\u30D7\u30ED\u30A4\u3092\u505C\u6B62\u3057\u307E\u3057\u305F\u3002\u5FA9\u65E7\u60C5\u5831\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_recoverySuggestion: "\u540C\u3058\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u540D\u3067\u518D\u8A66\u884C\u3059\u308B\u524D\u306B\u3001\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u306E\u30B3\u30F3\u30BD\u30FC\u30EB\u3067\u8A18\u8F09\u3055\u308C\u305F\u30EA\u30BD\u30FC\u30B9\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u300C\u4E0D\u660E\u300D\u306F\u3001\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u3088\u3063\u3066\u30EA\u30BD\u30FC\u30B9\u304C\u4F5C\u6210\u3055\u308C\u305F\u53EF\u80FD\u6027\u3092\u793A\u3057\u307E\u3059\u3002\u518D\u5229\u7528\u3057\u305F\u30EA\u30BD\u30FC\u30B9\u306F\u81EA\u52D5\u524A\u9664\u3055\u308C\u307E\u305B\u3093\u3002\u65B0\u898F\u30EA\u30BD\u30FC\u30B9\u306F\u4F7F\u7528\u72B6\u6CC1\u3092\u78BA\u8A8D\u3057\u3066\u304B\u3089\u624B\u52D5\u3067\u524A\u9664\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_commandTimeout: "\u30B3\u30DE\u30F3\u30C9\u304C\u30BF\u30A4\u30E0\u30A2\u30A6\u30C8\u3057\u307E\u3057\u305F: {command}",
+  deploy_commandFailed: "\u30B3\u30DE\u30F3\u30C9\u306B\u5931\u6557\u3057\u307E\u3057\u305F\uFF08{command}\uFF09: {error}",
+  deploy_remoteConnectFailed: "\u30EA\u30E2\u30FC\u30C8\u30DB\u30B9\u30C8{host}\u306B\u63A5\u7D9A\u3067\u304D\u307E\u305B\u3093: {error}",
+  deploy_remoteRuntimeMissing: "\u30EA\u30E2\u30FC\u30C8\u30DB\u30B9\u30C8\u306B\u30B3\u30F3\u30C6\u30CA\u30FC\u30E9\u30F3\u30BF\u30A4\u30E0\u307E\u305F\u306Fcompose\u304C\u3042\u308A\u307E\u305B\u3093: {runtime}",
+  deploy_imageTransferFailed: "\u30A4\u30E1\u30FC\u30B8\u306E\u8EE2\u9001\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_healthCheckFailed: "\u30D8\u30EB\u30B9\u30C1\u30A7\u30C3\u30AF\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002{url}\u3067\u30A2\u30D7\u30EA\u306E\u6E96\u5099\u304C\u5B8C\u4E86\u3057\u3066\u3044\u307E\u305B\u3093",
+  deploy_invalidEnvironment: "\u74B0\u5883\u540D\u306B\u306F\u82F1\u6570\u5B57\u3001\u30A2\u30F3\u30C0\u30FC\u30B9\u30B3\u30A2\u3001\u30CF\u30A4\u30D5\u30F3\u3092\u4F7F\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002local/example\u306F\u4E88\u7D04\u3055\u308C\u3066\u3044\u307E\u3059\u3002",
+  deploy_environmentMissing: "\u74B0\u5883\u30D5\u30A1\u30A4\u30EB\u304C\u3042\u308A\u307E\u305B\u3093: {path}\u3002\u30C7\u30D7\u30ED\u30A4\u524D\u306B\u4F5C\u6210\u3057\u3066\u8A2D\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_environmentReadFailed: "\u30C7\u30D7\u30ED\u30A4\u7528\u306E\u74B0\u5883\u30D5\u30A1\u30A4\u30EB\u3092\u8AAD\u307F\u53D6\u308C\u307E\u305B\u3093\u3002\u69CB\u6587\u3068\u6A29\u9650\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_environmentWriteFailed: "\u30C7\u30D7\u30ED\u30A4\u8A2D\u5B9A\u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3002\u30D5\u30A1\u30A4\u30EB\u306E\u69CB\u6587\u3068\u6A29\u9650\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_multipleApplications: "\u30B5\u30FC\u30D3\u30B9\u30D1\u30C3\u30B1\u30FC\u30B8\u304C\u8907\u6570\u898B\u3064\u304B\u308A\u307E\u3057\u305F\u3002\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_purposeSqlite: "\u30DC\u30EA\u30E5\u30FC\u30E0\u306B\u6C38\u7D9A\u5316\u3059\u308B\u30ED\u30FC\u30AB\u30EB\u30EA\u30EC\u30FC\u30B7\u30E7\u30CA\u30EB\u30C7\u30FC\u30BF\u30D9\u30FC\u30B9",
+  deploy_purposeDatabase: "\u696D\u52D9\u30C7\u30FC\u30BF\u7528\u306E\u30EA\u30EC\u30FC\u30B7\u30E7\u30CA\u30EB\u30C7\u30FC\u30BF\u30D9\u30FC\u30B9\u30B5\u30FC\u30D3\u30B9",
+  deploy_purposeMemory: "\u30D7\u30ED\u30BB\u30B9\u5358\u4F4D\u306E\u30E1\u30E2\u30EA\u30FC\u30AD\u30E3\u30C3\u30B7\u30E5\u3002\u518D\u8D77\u52D5\u6642\u306B\u6D88\u53BB\u3055\u308C\u3001\u5916\u90E8\u30B5\u30FC\u30D3\u30B9\u306F\u4F7F\u7528\u3057\u307E\u305B\u3093",
+  deploy_purposeLocal: "\u30DC\u30EA\u30E5\u30FC\u30E0\u306B\u6C38\u7D9A\u5316\u3059\u308B\u30ED\u30FC\u30AB\u30EB\u30D5\u30A1\u30A4\u30EB\u30B9\u30C8\u30EC\u30FC\u30B8",
+  deploy_purposeCache: "\u5171\u6709\u30AD\u30E3\u30C3\u30B7\u30E5\u3001\u30BB\u30C3\u30B7\u30E7\u30F3\u3001\u5206\u6563\u30ED\u30C3\u30AF",
+  deploy_purposeStorage: "\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u30D5\u30A1\u30A4\u30EB\u7528\u306ES3\u4E92\u63DB\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u30B9\u30C8\u30EC\u30FC\u30B8",
+  deploy_purposeVector: "\u30D9\u30AF\u30C8\u30EB\u306E\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u4F5C\u6210\u3068\u985E\u4F3C\u691C\u7D22",
+  deploy_purposeDisabled: "LDAP\u30ED\u30B0\u30A4\u30F3\u306F\u7121\u52B9\u3067\u3059\u3002\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u30B5\u30FC\u30D3\u30B9\u306F\u4F5C\u6210\u3057\u307E\u305B\u3093",
+  deploy_purposeLdap: "\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u30A2\u30AB\u30A6\u30F3\u30C8\u8A8D\u8A3C\u3002\u65E2\u5B9A\u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306B\u306F\u696D\u52D9\u30E6\u30FC\u30B6\u30FC\u306F\u3044\u307E\u305B\u3093",
+  deploy_purposeConsole: "\u914D\u4FE1\u305B\u305A\u3001\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u30ED\u30B0\u306B\u30E1\u30C3\u30BB\u30FC\u30B8\u3092\u51FA\u529B\u3057\u307E\u3059",
+  deploy_purposeEmail: "\u30E1\u30FC\u30EB/HTTP\u914D\u4FE1\u3002\u65E2\u5B9A\u306ESMTP\u30B3\u30F3\u30C6\u30CA\u30FC\u306F\u30C6\u30B9\u30C8\u30E1\u30C3\u30BB\u30FC\u30B8\u306E\u307F\u53D7\u4FE1\u3057\u307E\u3059",
+  deploy_purposeSms: "Aliyun\u306E\u8A8D\u8A3C\u60C5\u5831\u306B\u3088\u308BSMS\u3002\u65E2\u5B58\u306E\u7F72\u540D\u3068\u5229\u7528\u67A0\u304C\u5FC5\u8981\u3067\u3059",
+  deploy_webProxyInvalid: "API\u30D7\u30EC\u30D5\u30A3\u30C3\u30AF\u30B9\u306F\u3001\u82F1\u6570\u5B57\u3001\u30A2\u30F3\u30C0\u30FC\u30B9\u30B3\u30A2\u3001\u30CF\u30A4\u30D5\u30F3\u3001\u30B9\u30E9\u30C3\u30B7\u30E5\u306E\u307F\u3092\u542B\u3080\u7D76\u5BFE\u30D1\u30B9\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_artifactInvalid: "\u30A4\u30E1\u30FC\u30B8\u6210\u679C\u7269\u304C\u5B58\u5728\u3057\u306A\u3044\u304B\u3001\u7121\u52B9\u3067\u3059\u3002pnpm build --target docker \u3092\u5B9F\u884C\u3059\u308B\u304B\u3001--artifact-dir \u3067\u6709\u52B9\u306A\u6210\u679C\u7269\u3092\u9078\u629E\u3059\u308B\u304B\u3001pnpm run deploy --build \u3092\u4F7F\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_sshRequired: "\u81EA\u52D5\u30C7\u30D7\u30ED\u30A4\u306B\u306FSSH\u8A2D\u5B9A\u304C\u5FC5\u8981\u3067\u3059\u3002\u30B5\u30FC\u30D0\u30FC\u306B\u63A5\u7D9A\u3067\u304D\u306A\u3044\u5834\u5408\u306F--bundle-only\u3067\u624B\u52D5\u8EE2\u9001\u7528\u306E\u30D0\u30F3\u30C9\u30EB\u3092\u751F\u6210\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_bundleInstructions: "\u30D0\u30F3\u30C9\u30EB\uFF1A{file}\n\u9078\u629E\u3057\u305F\u30B5\u30FC\u30D3\u30B9\u306B\u5FC5\u8981\u306A\u3059\u3079\u3066\u306E\u30A4\u30E1\u30FC\u30B8\u3092\u542B\u307F\u307E\u3059\uFF08\u30BB\u30EB\u30D5\u30DB\u30B9\u30C8\u306E\u30DF\u30C9\u30EB\u30A6\u30A7\u30A2\u3092\u542B\u3080\uFF09\u3002\nSSH \u3092\u4F7F\u7528\u3059\u308B\u5834\u5408\u3001\u96A3\u63A5\u3059\u308B\u30C7\u30D7\u30ED\u30A4\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306E deploy-target.json \u3092 _comments \u306B\u5F93\u3063\u3066\u7DE8\u96C6\u3057\u3001\u540C\u3058\u5834\u6240\u3067 deploy.ps1\uFF08Windows\uFF09\u307E\u305F\u306F deploy.sh\uFF08Linux/macOS\uFF09\u3092\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u4E21\u65B9\u3068\u3082\u3053\u306E JSON \u3092\u8AAD\u307F\u8FBC\u307F\u307E\u3059\u3002sh \u306E\u5B9F\u884C\u306B\u306F\u30ED\u30FC\u30AB\u30EB\u306E awk \u3082\u5FC5\u8981\u3067\u3059\u3002\n\u9694\u96E2\u3055\u308C\u305F\u30B5\u30FC\u30D0\u30FC\u3067\u306F\u3001tar \u3092\u5225\u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3078\u30B3\u30D4\u30FC\u3057\u3066\u5C55\u958B\u3057\u3001sh apply.sh \u3092\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\uFF08\u8A2D\u5B9A\u3055\u308C\u305F\u5BFE\u8C61\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3092\u4F7F\u7528\u3057\u307E\u3059\uFF09\u3002\nLinux \u306B\u306F Docker/Podman\u3001Compose\u3001sh\u3001tar\u3001sha256sum\u3001awk\u3001curl\u3001util-linux \u306E flock \u304C\u5FC5\u8981\u3067\u3059\u3002flock \u306B\u5BFE\u5FDC\u3057\u305F\u30D5\u30A1\u30A4\u30EB\u30B7\u30B9\u30C6\u30E0\u4E0A\u3067\u3001\u30D5\u30A1\u30A4\u30EB\u30B7\u30B9\u30C6\u30E0\u3068\u30B3\u30F3\u30C6\u30CA\u30FC\u306E\u64CD\u4F5C\u6A29\u9650\u3082\u5FC5\u8981\u3067\u3059\u3002\n.deploy.lock \u306F\u524A\u9664\u3082\u7F6E\u63DB\u3082\u3057\u306A\u3044\u3067\u304F\u3060\u3055\u3044\u3002\u3059\u3079\u3066\u306E\u4FDD\u6301\u30D7\u30ED\u30BB\u30B9\u304C\u7D42\u4E86\u3059\u308B\u304B\u3001\u30B5\u30FC\u30D0\u30FC\u304C\u518D\u8D77\u52D5\u3059\u308B\u3068\u30ED\u30C3\u30AF\u304C\u89E3\u653E\u3055\u308C\u307E\u3059\u3002\u5F37\u5236\u7D42\u4E86\u5F8C\u306F\u5B9F\u884C\u72B6\u614B\u3068\u5FA9\u65E7\u72B6\u614B\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\n\u90E8\u5206\u66F4\u65B0\u306B\u306F\u30DD\u30FC\u30C8\u3068\u69CB\u6210\u304C\u4E00\u81F4\u3059\u308B\u6B63\u5E38\u306A\u5B8C\u5168\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u304C\u5FC5\u8981\u3067\u3059\u3002\u5404\u624B\u9806\u306F\u5931\u6557\u6642\u306B\u975E\u30BC\u30ED\u3067\u7D42\u4E86\u3057\u3001result-DEPLOYMENT_ID.json \u306B\u7D50\u679C\u3092\u8A18\u9332\u3057\u307E\u3059\u3002\n\u30D0\u30F3\u30C9\u30EB\u306B\u306F\u975E\u516C\u958B\u306E\u5B9F\u884C\u6642\u8A2D\u5B9A\u304C\u542B\u307E\u308C\u307E\u3059\u3002\u5B89\u5168\u306B\u8EE2\u9001\u3057\u3066\u304F\u3060\u3055\u3044\u3002\n\u540C\u68B1\u30A4\u30E1\u30FC\u30B8\uFF1A\n{images}",
+  deploy_bundleMetadata: "\u30A2\u30D7\u30EA\u306E\u30D0\u30FC\u30B8\u30E7\u30F3: {version}\n\u30D3\u30EB\u30C9ID: {buildId}\nCompose\u30D5\u30A1\u30A4\u30EB: {compose}",
+  deploy_targetHost: "\u5FC5\u9808\uFF1ALinux \u30B5\u30FC\u30D0\u30FC\u306E\u30A2\u30C9\u30EC\u30B9\u307E\u305F\u306F SSH \u30A8\u30A4\u30EA\u30A2\u30B9\u3002\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u30B9\u30AF\u30EA\u30D7\u30C8\u3092\u5B9F\u884C\u3059\u308B\u524D\u306B SERVER_HOST \u3092\u7F6E\u304D\u63DB\u3048\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_targetPort: "SSH \u30DD\u30FC\u30C8\u30021\u301C65535\u306E\u6574\u6570\u3002\u65E2\u5B9A\u5024\u306F22\u3067\u3059\u3002",
+  deploy_targetUsername: "SSH \u30ED\u30B0\u30A4\u30F3\u30E6\u30FC\u30B6\u30FC\u540D\u3002\u65E2\u5B9A\u5024\u306F deploy \u3067\u3059\u3002\u5BFE\u8C61\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3078\u306E\u66F8\u304D\u8FBC\u307F\u6A29\u9650\u3068\u30B3\u30F3\u30C6\u30CA\u30FC\u30E9\u30F3\u30BF\u30A4\u30E0\u306E\u64CD\u4F5C\u6A29\u9650\u304C\u5FC5\u8981\u3067\u3059\u3002",
+  deploy_targetIdentityFile: "\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u30B9\u30AF\u30EA\u30D7\u30C8\u3092\u5B9F\u884C\u3059\u308B\u7AEF\u672B\u4E0A\u306E\u79D8\u5BC6\u9375\u30D1\u30B9\uFF08\u7701\u7565\u53EF\uFF09\u3002\u7D76\u5BFE\u30D1\u30B9\u3092\u63A8\u5968\u3057\u307E\u3059\u3002\u7A7A\u6B04\u3067\u306F ssh-agent \u307E\u305F\u306F\u65E2\u5B9A\u306E\u9375\u3092\u4F7F\u7528\u3057\u307E\u3059\u3002HAI_DEPLOY_IDENTITY_FILE \u3067\u4E0A\u66F8\u304D\u3067\u304D\u307E\u3059\u3002",
+  deploy_targetKnownHostsFile: "\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u30B9\u30AF\u30EA\u30D7\u30C8\u3092\u5B9F\u884C\u3059\u308B\u7AEF\u672B\u4E0A\u306E known_hosts \u30D1\u30B9\uFF08\u7701\u7565\u53EF\uFF09\u3002\u7D76\u5BFE\u30D1\u30B9\u3092\u63A8\u5968\u3057\u307E\u3059\u3002\u7A7A\u6B04\u3067\u306F OpenSSH \u306E\u65E2\u5B9A\u5024\u3092\u4F7F\u7528\u3057\u307E\u3059\u3002HAI_DEPLOY_KNOWN_HOSTS_FILE \u3067\u4E0A\u66F8\u304D\u3067\u304D\u307E\u3059\u3002",
+  deploy_targetStrictHostKeyChecking: "\u771F\u507D\u5024\u3002\u65E2\u5B9A\u5024\u306E true \u306F\u65B0\u3057\u3044\u30DB\u30B9\u30C8\u9375\u3092\u4FE1\u983C\u3057\u3001\u5909\u66F4\u3055\u308C\u305F\u9375\u3092\u62D2\u5426\u3057\u307E\u3059\u3002false \u306F\u30DB\u30B9\u30C8\u9375\u306E\u691C\u8A3C\u3092\u7121\u52B9\u306B\u3057\u307E\u3059\u3002",
+  deploy_targetConnectTimeoutSeconds: "SSH \u63A5\u7D9A\u30BF\u30A4\u30E0\u30A2\u30A6\u30C8\uFF08\u79D2\uFF09\u30021\u301C2147483647\u306E\u6574\u6570\u3002\u65E2\u5B9A\u5024\u306F10\u3067\u3059\u3002",
+  deploy_targetDirectory: "\u5FC5\u9808\uFF1ALinux \u30B5\u30FC\u30D0\u30FC\u4E0A\u306E\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u306E\u7D76\u5BFE\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3002\u53D7\u4FE1\u30D1\u30C3\u30B1\u30FC\u30B8\u3001\u30EA\u30EA\u30FC\u30B9\u3001\u6210\u529F\u6642\u306E current \u72B6\u614B\u3092\u4FDD\u5B58\u3057\u307E\u3059\u3002\u89AA\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3078\u306E\u79FB\u52D5\u306F\u8A31\u53EF\u3055\u308C\u307E\u305B\u3093\u3002",
+  deploy_targetBundle: "\u5FC5\u9808\uFF1A\u3053\u306E\u30C7\u30D7\u30ED\u30A4\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306E\u89AA\u306B\u3042\u308B tar \u30D5\u30A1\u30A4\u30EB\u540D\u3002\u79FB\u52D5\u6642\u306F tar \u3068\u3053\u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u5168\u4F53\u3092\u4E00\u7DD2\u306B\u79FB\u52D5\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_bundleOnlyContainer: "Compose\u30D0\u30F3\u30C9\u30EB\u306E\u751F\u6210\u306Fdocker-ssh\u306E\u307F\u3067\u30B5\u30DD\u30FC\u30C8\u3055\u308C\u307E\u3059\u3002",
+  deploy_selectedContainerOnly: "\u30B5\u30FC\u30D3\u30B9\u3092\u9078\u629E\u3057\u305F\u30C7\u30D7\u30ED\u30A4\u306B\u306F docker-ssh Compose \u306E\u30C7\u30D7\u30ED\u30A4\u5148\u304C\u5FC5\u8981\u3067\u3059\u3002",
+  deploy_selectionInvalid: "{service} \u3092\u30C7\u30D7\u30ED\u30A4\u3067\u304D\u307E\u305B\u3093\u3002\u30B5\u30FC\u30D3\u30B9\u540D\u3092\u78BA\u8A8D\u3057\u3001\u5148\u306B\u30A4\u30E1\u30FC\u30B8\u3092\u30D3\u30EB\u30C9\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_imageVersionRequired: "\u30A4\u30E1\u30FC\u30B8\u306E\u30D0\u30FC\u30B8\u30E7\u30F3\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002latest \u306F\u4F7F\u7528\u3067\u304D\u307E\u305B\u3093\uFF1A{image}",
+  deploy_bundleRuntimeRequired: "\u30DF\u30C9\u30EB\u30A6\u30A7\u30A2\u30A4\u30E1\u30FC\u30B8\u3092\u30A8\u30AF\u30B9\u30DD\u30FC\u30C8\u3059\u308B\u306B\u306F\u30ED\u30FC\u30AB\u30EB\u306E Podman/Docker \u3092\u8D77\u52D5\u3059\u308B\u304B\u3001\u30D3\u30EB\u30C9\u7AEF\u672B\u3067\u5B8C\u5168\u306A\u30AA\u30D5\u30E9\u30A4\u30F3\u30D0\u30F3\u30C9\u30EB\u3092\u4F5C\u6210\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_bundleFailed: "\u30D1\u30C3\u30B1\u30FC\u30B8\u306E\u6E96\u5099\u307E\u305F\u306F\u30C7\u30D7\u30ED\u30A4\u306B\u5931\u6557\u3057\u307E\u3057\u305F\uFF1A{reason}",
+  deploy_configFileInvalid: "{path} \u306E {line} \u884C\u76EE\u306E YAML \u304C\u7121\u52B9\u3067\u3059\u3002\u30A4\u30F3\u30C7\u30F3\u30C8\u3001\u30B3\u30ED\u30F3\u3001\u5F15\u7528\u7B26\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_configFileUnreadable: "\u8A2D\u5B9A\u30D5\u30A1\u30A4\u30EB {path} \u3092\u8AAD\u307F\u8FBC\u3081\u307E\u305B\u3093\u3002\u30D1\u30B9\u3068\u6A29\u9650\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_bundleNameInvalid: "\u30D0\u30F3\u30C9\u30EB\u306E\u30D5\u30A1\u30A4\u30EB\u540D\u306B\u306F\u82F1\u6570\u5B57\u3001\u30C9\u30C3\u30C8\u3001\u30D7\u30E9\u30B9\u3001\u30CF\u30A4\u30D5\u30F3\u3001\u30A2\u30F3\u30C0\u30FC\u30B9\u30B3\u30A2\u3092\u4F7F\u7528\u3067\u304D\u307E\u3059\u3002\u89AA\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306B\u306F\u7A7A\u767D\u3092\u4F7F\u7528\u3067\u304D\u307E\u3059\u3002",
+  deploy_secretsInvalid: "\u30DF\u30C9\u30EB\u30A6\u30A7\u30A2\u306E\u8A8D\u8A3C\u60C5\u5831\u304C\u7834\u640D\u3057\u3066\u3044\u308B\u304B\u3001\u4E0D\u5B8C\u5168\u3067\u3059\uFF1A{path}\u3002\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u3092\u5FA9\u5143\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u65E2\u5B58\u30C7\u30FC\u30BF\u306B\u30A2\u30AF\u30BB\u30B9\u3067\u304D\u306A\u304F\u306A\u308B\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u3001\u30D1\u30B9\u30EF\u30FC\u30C9\u306F\u518D\u751F\u6210\u3057\u307E\u305B\u3093\u3002",
+  deploy_storageArtifactRequired: "\u30B9\u30C8\u30EC\u30FC\u30B8\u306E\u521D\u671F\u5316\u306B\u306F\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u30A4\u30E1\u30FC\u30B8\u304C\u5FC5\u8981\u3067\u3059\u3002--artifact-dir \u3067 app \u3092\u542B\u3080\u5B8C\u5168\u306A\u6210\u679C\u7269\u3092\u9078\u629E\u3059\u308B\u304B\u3001\u5148\u306B pnpm build --target docker --images app \u3092\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_localStopped: "\u30ED\u30FC\u30AB\u30EB\u30B3\u30DE\u30F3\u30C9\u306E\u30D7\u30ED\u30BB\u30B9\u30C4\u30EA\u30FC\u306E\u7D42\u4E86\u3092\u78BA\u8A8D\u3057\u307E\u3057\u305F\u3002",
+  deploy_localUnknown: "\u30ED\u30FC\u30AB\u30EB\u30D7\u30ED\u30BB\u30B9\u30C4\u30EA\u30FC\u306E\u7D42\u4E86\u306F\u672A\u78BA\u8A8D\u3067\u3059\u3002\u30ED\u30FC\u30AB\u30EB\u306E\u5B9F\u884C\u72B6\u614B\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_localNotStarted: "\u30ED\u30FC\u30AB\u30EB\u30B3\u30DE\u30F3\u30C9\u306F\u8D77\u52D5\u3057\u3066\u3044\u307E\u305B\u3093\u3002",
+  deploy_commandOutputFailed: "\u30B3\u30DE\u30F3\u30C9\u51FA\u529B\u307E\u305F\u306F\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  deploy_commandInputFailed: "\u30B3\u30DE\u30F3\u30C9\u5165\u529B\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  deploy_commandTreeActive: "\u30E1\u30A4\u30F3\u30B3\u30DE\u30F3\u30C9\u7D42\u4E86\u5F8C\u3082\u5B50\u30D7\u30ED\u30BB\u30B9\u304C\u52D5\u4F5C\u3057\u3066\u3044\u307E\u3059",
+  deploy_commandExecutionFailed: "\u30B3\u30DE\u30F3\u30C9\u306E\u5B9F\u884C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  deploy_remoteUnknown: "\u30EA\u30E2\u30FC\u30C8\u306E\u5B9F\u884C\u72B6\u614B\u306F\u4E0D\u660E\u3067\u3059\u3002\u30ED\u30FC\u30AB\u30EB SSH \u306E\u7D42\u4E86\u306F\u30EA\u30E2\u30FC\u30C8\u30C7\u30D7\u30ED\u30A4\u306E\u505C\u6B62\u3092\u610F\u5473\u3057\u307E\u305B\u3093\u3002\u30B5\u30FC\u30D0\u30FC\u306E\u7D50\u679C\u3068\u5B9F\u969B\u306E\u30B3\u30F3\u30C6\u30CA\u30FC\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_remoteFinished: "\u5BFE\u5FDC\u3059\u308B\u30B5\u30FC\u30D0\u30FC\u306E\u7D50\u679C\u306B\u3088\u308A\u3001\u30C7\u30D7\u30ED\u30A4\u30B9\u30AF\u30EA\u30D7\u30C8\u3068\u5FA9\u65E7\u51E6\u7406\u306E\u7D42\u4E86\u3092\u78BA\u8A8D\u3057\u307E\u3057\u305F\uFF1A\u6BB5\u968E {stage}\u3001\u7D42\u4E86\u30B3\u30FC\u30C9 {code}\u3002\u5B9F\u969B\u306E\u30B5\u30FC\u30D3\u30B9\u306E\u7A3C\u50CD\u72B6\u614B\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
 };
 
 // messages/zh-CN.json
@@ -177,8 +283,17 @@ var zh_CN_default = {
   deploy_webProxyInvalid: "API \u524D\u7F00\u5FC5\u987B\u662F\u4EC5\u542B\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u3001\u8FDE\u5B57\u7B26\u548C\u659C\u6760\u7684\u7EDD\u5BF9\u8DEF\u5F84\u3002",
   deploy_artifactInvalid: "\u955C\u50CF\u4EA7\u7269\u7F3A\u5931\u6216\u6821\u9A8C\u5931\u8D25\u3002\u8BF7\u5148\u6267\u884C pnpm build --target docker\uFF0C\u6216\u7528 --artifact-dir \u6307\u5B9A\u6709\u6548\u4EA7\u7269\uFF1B\u4E5F\u53EF\u7528 pnpm run deploy --build \u4E00\u6B21\u5B8C\u6210\u3002",
   deploy_sshRequired: "\u81EA\u52A8\u90E8\u7F72\u9700\u8981 SSH \u914D\u7F6E\uFF1B\u65E0\u7F51\u7EDC\u8FDE\u63A5\u65F6\u4F7F\u7528 --bundle-only \u751F\u6210\u90E8\u7F72\u5305\u5E76\u624B\u5DE5\u642C\u8FD0\u3002",
-  deploy_bundleInstructions: "\u90E8\u7F72\u5305\uFF1A{file}\n\u5305\u4E2D\u5DF2\u5305\u542B\u672C\u6B21\u9009\u62E9\u670D\u52A1\u9700\u8981\u7684\u955C\u50CF\uFF0C\u5305\u62EC\u81EA\u5EFA\u4E2D\u95F4\u4EF6\u3002\n\u6709 SSH \u8FDE\u63A5\u65F6\uFF0C\u5728\u65C1\u8FB9\u7684\u90E8\u7F72\u76EE\u5F55\u8FD0\u884C deploy.ps1\uFF08Windows\uFF09\u6216 deploy.sh\uFF08Linux/macOS\uFF09\u3002\n\u5B8C\u5168\u9694\u79BB\u65F6\uFF0C\u590D\u5236 tar \u5230 Linux \u670D\u52A1\u5668\uFF0C\u5728\u72EC\u7ACB\u76EE\u5F55\u89E3\u5305\uFF0C\u518D\u6267\u884C sh apply.sh /opt/hai/apps/\u9879\u76EE\u73AF\u5883\u3002\n\u670D\u52A1\u5668\u9700\u8981 Docker/Podman\u3001Compose\u3001sh\u3001tar\u3001sha256sum\u3001awk \u548C curl\uFF0C\u4EE5\u53CA\u76EE\u5F55\u3001\u5BB9\u5668\u8FD0\u884C\u6743\u9650\u3002\n\u90E8\u5206\u66F4\u65B0\u8981\u6C42\u670D\u52A1\u5668\u5DF2\u6709\u6210\u529F\u7684\u5B8C\u6574\u90E8\u7F72\uFF0C\u7AEF\u53E3\u53CA\u5E94\u7528\u5E03\u5C40\u4FDD\u6301\u4E00\u81F4\u3002\u6BCF\u6B65\u5931\u8D25\u4F1A\u8FD4\u56DE\u975E\u96F6\u9000\u51FA\u7801\uFF1B\u7ED3\u679C\u8BB0\u5F55\u5728\u90E8\u7F72\u76EE\u5F55 result-\u90E8\u7F72ID.json\u3002\n\u5305\u5305\u542B\u79C1\u6709\u8FD0\u884C\u914D\u7F6E\uFF0C\u8BF7\u5B89\u5168\u4F20\u8F93\u3002\n\u6240\u542B\u955C\u50CF\uFF1A\n{images}",
+  deploy_bundleInstructions: "\u90E8\u7F72\u5305\uFF1A{file}\n\u5305\u4E2D\u5DF2\u5305\u542B\u672C\u6B21\u9009\u62E9\u670D\u52A1\u9700\u8981\u7684\u955C\u50CF\uFF0C\u5305\u62EC\u81EA\u5EFA\u4E2D\u95F4\u4EF6\u3002\n\u6709 SSH \u8FDE\u63A5\u65F6\uFF0C\u5148\u6309 _comments \u8BF4\u660E\u4FEE\u6539\u65C1\u8FB9\u90E8\u7F72\u76EE\u5F55\u4E2D\u7684 deploy-target.json\uFF0C\u518D\u8FD0\u884C\u540C\u76EE\u5F55\u7684 deploy.ps1\uFF08Windows\uFF09\u6216 deploy.sh\uFF08Linux/macOS\uFF09\uFF1B\u4E24\u8005\u5747\u8BFB\u53D6\u6B64 JSON\uFF0Csh \u5165\u53E3\u8FD8\u9700\u672C\u673A\u5B89\u88C5 awk\u3002\n\u5B8C\u5168\u9694\u79BB\u65F6\uFF0C\u590D\u5236 tar \u5230 Linux \u670D\u52A1\u5668\uFF0C\u5728\u72EC\u7ACB\u76EE\u5F55\u89E3\u5305\uFF0C\u518D\u6267\u884C sh apply.sh\uFF08\u4F7F\u7528\u5305\u4E2D\u914D\u7F6E\u7684\u76EE\u6807\u76EE\u5F55\uFF09\u3002\n\u670D\u52A1\u5668\u9700\u8981 Docker/Podman\u3001Compose\u3001sh\u3001tar\u3001sha256sum\u3001awk\u3001curl\u3001util-linux flock\uFF0C\u4EE5\u53CA\u652F\u6301 flock \u7684\u6587\u4EF6\u7CFB\u7EDF\u548C\u76EE\u5F55\u3001\u5BB9\u5668\u8FD0\u884C\u6743\u9650\u3002\n\u56FA\u5B9A\u9501\u6587\u4EF6 .deploy.lock \u7981\u6B62\u5220\u9664\u6216\u66FF\u6362\uFF1B\u5168\u90E8\u6301\u6709\u8FDB\u7A0B\u9000\u51FA\u6216\u91CD\u542F\u540E\u81EA\u52A8\u91CA\u653E\u3002\u5F3A\u6740\u540E\u7684\u6267\u884C\u4E0E\u6062\u590D\u72B6\u6001\u987B\u4EBA\u5DE5\u6838\u5BF9\u3002\n\u90E8\u5206\u66F4\u65B0\u8981\u6C42\u670D\u52A1\u5668\u5DF2\u6709\u6210\u529F\u7684\u5B8C\u6574\u90E8\u7F72\uFF0C\u7AEF\u53E3\u53CA\u5E94\u7528\u5E03\u5C40\u4FDD\u6301\u4E00\u81F4\u3002\u6BCF\u6B65\u5931\u8D25\u4F1A\u8FD4\u56DE\u975E\u96F6\u9000\u51FA\u7801\uFF1B\u7ED3\u679C\u8BB0\u5F55\u5728\u90E8\u7F72\u76EE\u5F55 result-\u90E8\u7F72ID.json\u3002\n\u5305\u5305\u542B\u79C1\u6709\u8FD0\u884C\u914D\u7F6E\uFF0C\u8BF7\u5B89\u5168\u4F20\u8F93\u3002\n\u6240\u542B\u955C\u50CF\uFF1A\n{images}",
   deploy_bundleMetadata: "\u5E94\u7528\u7248\u672C\uFF1A{version}\n\u6784\u5EFA\u7F16\u53F7\uFF1A{buildId}\nCompose \u6587\u4EF6\uFF1A{compose}",
+  deploy_targetHost: "\u5FC5\u586B\uFF1ALinux \u670D\u52A1\u5668\u5730\u5740\u6216 SSH \u522B\u540D\u3002\u6267\u884C\u4EFB\u4E00\u4E0A\u4F20\u811A\u672C\u524D\uFF0C\u5C06 SERVER_HOST \u6539\u4E3A\u5B9E\u9645\u5730\u5740\u3002",
+  deploy_targetPort: "SSH \u7AEF\u53E3\uFF0C1-65535 \u7684\u6574\u6570\uFF0C\u9ED8\u8BA4 22\u3002",
+  deploy_targetUsername: "SSH \u767B\u5F55\u7528\u6237\u540D\uFF0C\u9ED8\u8BA4 deploy\uFF1B\u9700\u8981\u76EE\u6807\u76EE\u5F55\u5199\u5165\u6743\u9650\u53CA\u5BB9\u5668\u8FD0\u884C\u6743\u9650\u3002",
+  deploy_targetIdentityFile: "\u53EF\u9009\uFF1A\u8FD0\u884C\u4E0A\u4F20\u811A\u672C\u7684\u7535\u8111\u4E0A\u7684\u79C1\u94A5\u8DEF\u5F84\uFF0C\u5EFA\u8BAE\u7EDD\u5BF9\u8DEF\u5F84\uFF1B\u7559\u7A7A\u4F7F\u7528 ssh-agent \u6216\u9ED8\u8BA4\u5BC6\u94A5\u3002HAI_DEPLOY_IDENTITY_FILE \u53EF\u8986\u76D6\u3002",
+  deploy_targetKnownHostsFile: "\u53EF\u9009\uFF1A\u8FD0\u884C\u4E0A\u4F20\u811A\u672C\u7684\u7535\u8111\u4E0A\u7684 known_hosts \u8DEF\u5F84\uFF0C\u5EFA\u8BAE\u7EDD\u5BF9\u8DEF\u5F84\uFF1B\u7559\u7A7A\u4F7F\u7528 OpenSSH \u9ED8\u8BA4\u6587\u4EF6\u3002HAI_DEPLOY_KNOWN_HOSTS_FILE \u53EF\u8986\u76D6\u3002",
+  deploy_targetStrictHostKeyChecking: "\u5E03\u5C14\u503C\uFF0C\u9ED8\u8BA4 true\uFF1A\u9996\u6B21\u4FE1\u4EFB\u65B0\u4E3B\u673A\u5BC6\u94A5\uFF0C\u62D2\u7EDD\u5DF2\u53D8\u66F4\u5BC6\u94A5\uFF1Bfalse \u5173\u95ED\u4E3B\u673A\u5BC6\u94A5\u68C0\u67E5\u3002",
+  deploy_targetConnectTimeoutSeconds: "SSH \u8FDE\u63A5\u8D85\u65F6\u79D2\u6570\uFF0C1-2147483647 \u7684\u6574\u6570\uFF0C\u9ED8\u8BA4 10\u3002",
+  deploy_targetDirectory: "\u5FC5\u586B\uFF1ALinux \u670D\u52A1\u5668\u4E0A\u7684\u5E94\u7528\u7EDD\u5BF9\u76EE\u5F55\uFF0C\u4FDD\u5B58 incoming \u90E8\u7F72\u5305\u3001releases \u53CA\u6210\u529F\u72B6\u6001 current\uFF1B\u7981\u6B62 .. \u7236\u76EE\u5F55\u8DF3\u8F6C\u3002",
+  deploy_targetBundle: "\u5FC5\u586B\uFF1A\u672C\u90E8\u7F72\u64CD\u4F5C\u76EE\u5F55\u4E0A\u4E00\u7EA7\u7684 tar \u6587\u4EF6\u540D\uFF1B\u642C\u8FD0\u65F6\u8BF7\u5C06 tar \u548C\u672C\u76EE\u5F55\u5B8C\u6574\u653E\u5728\u4E00\u8D77\u3002",
   deploy_bundleOnlyContainer: "\u4EC5\u751F\u6210 Compose tar \u53EA\u652F\u6301 docker-ssh\u3002",
   deploy_selectedContainerOnly: "\u6309\u670D\u52A1\u5C40\u90E8\u90E8\u7F72\u4EC5\u9002\u7528\u4E8E docker-ssh Compose \u76EE\u6807\u3002",
   deploy_selectionInvalid: "\u65E0\u6CD5\u90E8\u7F72\u670D\u52A1 {service}\uFF1A\u8BF7\u68C0\u67E5\u670D\u52A1\u540D\u79F0\uFF0C\u5E76\u5148\u6784\u5EFA\u5BF9\u5E94\u955C\u50CF\u3002",
@@ -189,13 +304,23 @@ var zh_CN_default = {
   deploy_configFileInvalid: "\u914D\u7F6E\u6587\u4EF6 {path} \u7B2C {line} \u884C\u683C\u5F0F\u6709\u8BEF\u3002\u8BF7\u68C0\u67E5\u7F29\u8FDB\u3001\u5192\u53F7\u548C\u5F15\u53F7\u540E\u91CD\u8BD5\u3002",
   deploy_configFileUnreadable: "\u65E0\u6CD5\u8BFB\u53D6\u914D\u7F6E\u6587\u4EF6 {path}\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u8DEF\u5F84\u4E0E\u8BFB\u53D6\u6743\u9650\u3002",
   deploy_bundleNameInvalid: "\u90E8\u7F72\u5305\u6587\u4EF6\u540D\u53EA\u652F\u6301\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u70B9\u3001\u52A0\u53F7\u3001\u77ED\u6A2A\u7EBF\u548C\u4E0B\u5212\u7EBF\uFF1B\u6240\u5728\u76EE\u5F55\u53EF\u4EE5\u5305\u542B\u7A7A\u683C\u3002",
-  deploy_secretsInvalid: "\u4E2D\u95F4\u4EF6\u51ED\u636E\u6587\u4EF6\u635F\u574F\u6216\u7F3A\u5C11\u5B57\u6BB5\uFF1A{path}\u3002\u8BF7\u4ECE\u5907\u4EFD\u6062\u590D\uFF1B\u4E0D\u4F1A\u81EA\u52A8\u66F4\u6362\u5BC6\u7801\uFF0C\u4EE5\u514D\u5DF2\u6709\u6570\u636E\u65E0\u6CD5\u8BBF\u95EE\u3002"
+  deploy_secretsInvalid: "\u4E2D\u95F4\u4EF6\u51ED\u636E\u6587\u4EF6\u635F\u574F\u6216\u7F3A\u5C11\u5B57\u6BB5\uFF1A{path}\u3002\u8BF7\u4ECE\u5907\u4EFD\u6062\u590D\uFF1B\u4E0D\u4F1A\u81EA\u52A8\u66F4\u6362\u5BC6\u7801\uFF0C\u4EE5\u514D\u5DF2\u6709\u6570\u636E\u65E0\u6CD5\u8BBF\u95EE\u3002",
+  deploy_localStopped: "\u5DF2\u786E\u8BA4\u672C\u5730\u547D\u4EE4\u8FDB\u7A0B\u6811\u5168\u90E8\u9000\u51FA\u3002",
+  deploy_localUnknown: "\u65E0\u6CD5\u786E\u8BA4\u672C\u5730\u547D\u4EE4\u8FDB\u7A0B\u6811\u5DF2\u5168\u90E8\u9000\u51FA\uFF1B\u8BF7\u68C0\u67E5\u672C\u673A\u6267\u884C\u72B6\u6001\u3002",
+  deploy_localNotStarted: "\u672C\u5730\u547D\u4EE4\u5C1A\u672A\u542F\u52A8\u3002",
+  deploy_commandOutputFailed: "\u547D\u4EE4\u8F93\u51FA\u6216\u56DE\u8C03\u5931\u8D25",
+  deploy_commandInputFailed: "\u547D\u4EE4\u8F93\u5165\u5931\u8D25",
+  deploy_commandTreeActive: "\u4E3B\u547D\u4EE4\u9000\u51FA\u540E\u4ECD\u6709\u6D3B\u8DC3\u7684\u5B50\u8FDB\u7A0B",
+  deploy_commandExecutionFailed: "\u547D\u4EE4\u6267\u884C\u5931\u8D25",
+  deploy_remoteUnknown: "\u8FDC\u7AEF\u6267\u884C\u72B6\u6001\u672A\u77E5\uFF1B\u672C\u5730 SSH \u7ED3\u675F\u4E0D\u8BC1\u660E\u8FDC\u7AEF\u90E8\u7F72\u5DF2\u505C\u6B62\uFF0C\u8BF7\u6838\u5BF9\u670D\u52A1\u5668\u7ED3\u679C\u4E0E\u5B9E\u9645\u5BB9\u5668\u72B6\u6001\u3002",
+  deploy_remoteFinished: "\u5339\u914D\u7684\u670D\u52A1\u5668\u7ED3\u679C\u786E\u8BA4\u90E8\u7F72\u811A\u672C\u53CA\u6062\u590D\u5DF2\u7ED3\u675F\uFF1A\u9636\u6BB5 {stage}\uFF0C\u9000\u51FA\u7801 {code}\u3002\u8BF7\u6838\u5BF9\u5B9E\u9645\u670D\u52A1\u5065\u5EB7\u72B6\u6001\u3002"
 };
 
 // src/deploy-i18n.ts
 var deployM = core.i18n.createMessageGetter({
   "zh-CN": zh_CN_default,
-  "en-US": en_US_default
+  "en-US": en_US_default,
+  "ja-JP": ja_JP_default
 });
 
 // src/deploy-config.ts
@@ -358,7 +483,7 @@ function loadDeploymentEnvironment(options) {
     return loaded;
   try {
     const values = { ...loaded.data };
-    for (const [name, value] of Object.entries(process2.env)) {
+    for (const [name, value] of Object.entries(process3.env)) {
       if (/^(?:HAI_|PUBLIC_|VITE_)/.test(name) && value !== void 0)
         values[name] = value;
     }
@@ -546,7 +671,7 @@ function loadCredentials() {
     const data = readCredentialsFile();
     const keys = Object.keys(data);
     for (const key of keys) {
-      process2.env[key] = String(data[key]);
+      process3.env[key] = String(data[key]);
     }
     logger.debug("Credentials loaded", { count: keys.length });
     return ok(keys);
@@ -567,7 +692,7 @@ function saveCredential(key, value) {
     const data = readCredentialsFile();
     data[key] = value;
     writeCredentialsFile(data);
-    process2.env[key] = value;
+    process3.env[key] = value;
     logger.debug("Credential saved", { key });
     return ok(void 0);
   } catch (error) {
@@ -587,7 +712,7 @@ function saveCredentials(entries) {
     const data = readCredentialsFile();
     for (const [key, value] of Object.entries(entries)) {
       data[key] = value;
-      process2.env[key] = value;
+      process3.env[key] = value;
     }
     writeCredentialsFile(data);
     logger.debug("Credentials saved", { count: Object.keys(entries).length });
@@ -603,17 +728,20 @@ function saveCredentials(entries) {
     );
   }
 }
-function resolveArtifactDirectory(appDir) {
+function resolveProjectDirectory(appDir) {
   let directory = resolve(appDir);
   while (true) {
     if (existsSync(join(directory, "hai.build.json")) || existsSync(join(directory, "pnpm-lock.yaml")))
-      return join(directory, ".hai/build/docker");
+      return directory;
     const parent = dirname(directory);
     if (parent === directory)
-      return join(appDir, ".hai/build/docker");
+      return resolve(appDir);
     directory = parent;
   }
 }
+function resolveArtifactDirectory(appDir) {
+  return join(resolveProjectDirectory(appDir), ".hai/build/docker");
+}
 function usesDefaultMiddleware(scan, service, options) {
   const requirements = scan.middlewares?.filter((item) => item.service === service) ?? [];
   return requirements.length ? requirements.some((item) => (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.[service] ?? "default") === "default") : (options?.serviceModes?.[service] ?? "default") === "default";
@@ -637,6 +765,19 @@ var RecoverySchema = z.object({
     resourceStatus: z.enum(["created", "reused", "unknown"])
   }))
 });
+var CommandStateSchema = z.object({
+  reason: z.enum(["timeout", "output", "input", "spawn", "exit", "configuration"]),
+  localTermination: z.enum(["confirmed", "unknown", "not-started"]),
+  remoteExecution: z.enum(["unknown", "finished"]).optional(),
+  deploymentId: z.string().optional(),
+  resultFile: z.string().optional(),
+  remoteExitCode: z.number().int().optional(),
+  remoteStage: z.string().optional()
+});
+function getDeployCommandState(error) {
+  const parsed = CommandStateSchema.safeParse(error.ext?.commandExecution);
+  return parsed.success ? parsed.data : void 0;
+}
 function getDeployRecovery(error) {
   const parsed = RecoverySchema.safeParse(error.ext?.recovery);
   return parsed.success ? parsed.data : void 0;
@@ -753,7 +894,7 @@ async function scanApp(inputDir, options) {
       for (const [index, item] of providers.entries()) {
         const provider = record(item);
         const type = String(provider.type ?? "");
-        const service = type === "aliyun-sms" ? "sms" : ["smtp", "api", "console"].includes(type) ? "email" : void 0;
+        const service = type === "aliyun-sms" || ["console", "api"].includes(type) && provider.name === "sms" ? "sms" : ["smtp", "api", "console"].includes(type) ? "email" : void 0;
         if (service)
           add(service, type, "reach", ["providers", String(index)], provider, "@h-ai/reach");
       }
@@ -779,91 +920,575 @@ async function scanApp(inputDir, options) {
     return err(HaiDeployError.SCAN_FAILED, deployM("deploy_scanFailed", { params: { error: "Invalid or ambiguous application/configuration/lockfile; specify the application directory and run pnpm install" } }));
   }
 }
-var logger3 = core.logger.child({ module: "deploy", scope: "command" });
-function maskSecrets(text, secrets) {
-  if (!secrets || secrets.length === 0)
-    return text;
-  let masked = text;
-  for (const secret of secrets) {
-    if (secret && secret.length > 0)
-      masked = masked.split(secret).join("***");
+var nativeJob = String.raw`
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading;
+
+public static class HaiCommandJob {
+  [StructLayout(LayoutKind.Sequential)] struct BasicLimits {
+    public long ProcessTime, JobTime;
+    public uint Flags;
+    public UIntPtr MinimumWorkingSet, MaximumWorkingSet;
+    public uint ActiveProcessLimit;
+    public UIntPtr Affinity;
+    public uint PriorityClass, SchedulingClass;
+  }
+  [StructLayout(LayoutKind.Sequential)] struct IoCounters {
+    public ulong ReadOperations, WriteOperations, OtherOperations, ReadBytes, WriteBytes, OtherBytes;
+  }
+  [StructLayout(LayoutKind.Sequential)] struct ExtendedLimits {
+    public BasicLimits Basic;
+    public IoCounters Io;
+    public UIntPtr ProcessMemory, JobMemory, PeakProcessMemory, PeakJobMemory;
+  }
+  [StructLayout(LayoutKind.Sequential)] struct Accounting {
+    public long UserTime, KernelTime, PeriodUserTime, PeriodKernelTime;
+    public uint Faults, Total, Active, Terminated;
+  }
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] struct Startup {
+    public uint Size;
+    public string Reserved, Desktop, Title;
+    public uint X, Y, Width, Height, XChars, YChars, Fill, Flags;
+    public ushort Show, ReservedSize;
+    public IntPtr ReservedData, Input, Output, Error;
+  }
+  [StructLayout(LayoutKind.Sequential)] struct ProcessInfo {
+    public IntPtr Process, Thread;
+    public uint ProcessId, ThreadId;
+  }
+  [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)] static extern IntPtr CreateJobObject(IntPtr attributes, string name);
+  [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)] static extern IntPtr OpenJobObject(uint access, bool inherit, string name);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool SetInformationJobObject(IntPtr job, int kind, ref ExtendedLimits information, uint size);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool QueryInformationJobObject(IntPtr job, int kind, out Accounting information, uint size, IntPtr length);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);
+  [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)] static extern bool CreateProcess(string application, StringBuilder command, IntPtr processAttributes, IntPtr threadAttributes, bool inherit, uint flags, IntPtr environment, string directory, ref Startup startup, out ProcessInfo information);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern uint ResumeThread(IntPtr thread);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool TerminateProcess(IntPtr process, uint code);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool TerminateJobObject(IntPtr job, uint code);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern uint WaitForSingleObject(IntPtr handle, uint milliseconds);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool GetExitCodeProcess(IntPtr process, out uint code);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool CloseHandle(IntPtr handle);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern IntPtr GetStdHandle(int kind);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool SetHandleInformation(IntPtr handle, uint mask, uint flags);
+
+  static void Check(bool success) { if (!success) throw new Win32Exception(Marshal.GetLastWin32Error()); }
+  static uint Active(IntPtr job) {
+    Accounting information;
+    Check(QueryInformationJobObject(job, 1, out information, (uint)Marshal.SizeOf(typeof(Accounting)), IntPtr.Zero));
+    return information.Active;
+  }
+  // Windows argv 编码：引号前与结尾的反斜杠加倍，其余字符原样传递，不经过命令 shell。
+  static string Quote(string value) {
+    StringBuilder result = new StringBuilder("\"");
+    int slashes = 0;
+    foreach (char current in value) {
+      if (current == '\\') { slashes++; continue; }
+      if (current == '"') result.Append('\\', slashes * 2 + 1);
+      else result.Append('\\', slashes);
+      result.Append(current);
+      slashes = 0;
+    }
+    result.Append('\\', slashes * 2).Append('"');
+    return result.ToString();
+  }
+  public static int Run(string name, string command, string[] arguments) {
+    IntPtr job = CreateJobObject(IntPtr.Zero, name);
+    if (job == IntPtr.Zero) throw new Win32Exception(Marshal.GetLastWin32Error());
+    ProcessInfo process = new ProcessInfo();
+    bool assigned = false;
+    try {
+      ExtendedLimits limits = new ExtendedLimits();
+      limits.Basic.Flags = 0x2000; // JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE；不允许 breakaway。
+      Check(SetInformationJobObject(job, 9, ref limits, (uint)Marshal.SizeOf(typeof(ExtendedLimits))));
+      StringBuilder line = new StringBuilder(Quote(command));
+      foreach (string argument in arguments) line.Append(' ').Append(Quote(argument));
+      Startup startup = new Startup();
+      startup.Size = (uint)Marshal.SizeOf(typeof(Startup));
+      startup.Flags = 0x100;
+      startup.Input = GetStdHandle(-10); startup.Output = GetStdHandle(-11); startup.Error = GetStdHandle(-12);
+      Check(SetHandleInformation(startup.Input, 1, 1));
+      Check(SetHandleInformation(startup.Output, 1, 1));
+      Check(SetHandleInformation(startup.Error, 1, 1));
+      Check(CreateProcess(null, line, IntPtr.Zero, IntPtr.Zero, true, 0x08000004, IntPtr.Zero, null, ref startup, out process));
+      Check(AssignProcessToJobObject(job, process.Process));
+      assigned = true;
+      if (ResumeThread(process.Thread) == 0xFFFFFFFF) throw new Win32Exception(Marshal.GetLastWin32Error());
+      if (WaitForSingleObject(process.Process, 0xFFFFFFFF) != 0) throw new Win32Exception(Marshal.GetLastWin32Error());
+      uint code;
+      Check(GetExitCodeProcess(process.Process, out code));
+      while (Active(job) != 0) Thread.Sleep(20);
+      return unchecked((int)code);
+    }
+    finally {
+      if (process.Process != IntPtr.Zero) {
+        // 分配失败时进程仍挂起，直接终止，不允许裸进程恢复；Job 在其他异常时同样清空。
+        if (!assigned) TerminateProcess(process.Process, 125);
+        else TerminateJobObject(job, 125);
+        WaitForSingleObject(process.Process, 5000);
+      }
+      if (process.Thread != IntPtr.Zero) CloseHandle(process.Thread);
+      if (process.Process != IntPtr.Zero) CloseHandle(process.Process);
+      CloseHandle(job);
+    }
+  }
+  public static bool Empty(string name) {
+    IntPtr job = OpenJobObject(4, false, name); // JOB_OBJECT_QUERY
+    if (job == IntPtr.Zero) {
+      if (Marshal.GetLastWin32Error() == 2) return true;
+      throw new Win32Exception(Marshal.GetLastWin32Error());
+    }
+    try { return Active(job) == 0; }
+    finally { CloseHandle(job); }
+  }
+}
+`;
+function powershell(script) {
+  return ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")];
+}
+function windowsCommand(command, args) {
+  const name = `Local\\hai-deploy-${randomUUID()}`;
+  const key = `__HAI_DEPLOY_JOB_${randomUUID().replaceAll("-", "")}`;
+  const script = `$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue'; $InformationPreference='SilentlyContinue'
+try {
+  Add-Type -TypeDefinition @'
+${nativeJob}
+'@
+  $inputConfig = [Environment]::GetEnvironmentVariable('${key}') | ConvertFrom-Json
+  [Environment]::SetEnvironmentVariable('${key}', $null)
+  exit ([HaiCommandJob]::Run([string]$inputConfig.name, [string]$inputConfig.command, [string[]]$inputConfig.args))
+} catch { [Console]::Error.WriteLine('Windows command job failed'); exit 125 }`;
+  return { name, args: powershell(script), env: { [key]: JSON.stringify({ name, command, args }) } };
+}
+function windowsJobProbe(name) {
+  return powershell(`$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue'; $InformationPreference='SilentlyContinue'
+try {
+  Add-Type -TypeDefinition @'
+${nativeJob}
+'@
+  if ([HaiCommandJob]::Empty('${name}')) { exit 0 } else { exit 1 }
+} catch { exit 2 }`);
+}
+
+// src/container/deploy-command-process.ts
+async function groupExited(pid) {
+  try {
+    process3.kill(-pid, 0);
+  } catch (error) {
+    return error instanceof Error && "code" in error && error.code === "ESRCH";
+  }
+  if (process3.platform !== "linux")
+    return false;
+  try {
+    for (const entry of await readdir("/proc")) {
+      if (!/^\d+$/.test(entry))
+        continue;
+      let stat;
+      try {
+        stat = await readFile(`/proc/${entry}/stat`, "utf8");
+      } catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+          continue;
+        return false;
+      }
+      const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+      if (Number(fields[2]) === pid && fields[0] !== "Z" && fields[0] !== "X")
+        return false;
+    }
+    return true;
+  } catch {
+    return false;
   }
-  return masked;
 }
-function runCommand(command, args, options = {}) {
+async function helper(command, args, timeoutMs) {
+  if (timeoutMs <= 0)
+    return false;
   return new Promise((resolve6) => {
-    const child = spawn(command, args, {
-      windowsHide: true,
-      cwd: options.cwd,
-      env: options.env ? { ...process2.env, ...options.env } : process2.env,
-      shell: false
-    });
-    let stdout = "";
-    let stderr = "";
+    const child = spawn(command, args, { windowsHide: true, shell: false, stdio: "ignore" });
     let settled = false;
     let timer;
-    const finish = (result) => {
+    const finish = (success) => {
       if (settled)
         return;
       settled = true;
       if (timer)
         clearTimeout(timer);
-      resolve6(result);
+      resolve6(success);
     };
-    if (options.timeoutMs && options.timeoutMs > 0) {
-      timer = setTimeout(() => {
-        child.kill("SIGKILL");
-        logger3.error("Command timed out", { command, timeoutMs: options.timeoutMs });
-        finish(err(
-          HaiDeployError.REMOTE_COMMAND_FAILED,
-          deployM("deploy_commandTimeout", { params: { command } })
-        ));
-      }, options.timeoutMs);
-    }
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString("utf-8");
-      options.onOutput?.(maskSecrets(chunk.toString("utf-8"), options.secrets));
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk.toString("utf-8");
-    });
-    child.on("error", (error) => {
-      logger3.error("Command failed to start", { command, error: maskSecrets(String(error), options.secrets) });
-      finish(err(
-        HaiDeployError.REMOTE_COMMAND_FAILED,
-        deployM("deploy_commandFailed", {
-          params: { command, error: maskSecrets(error.message, options.secrets) }
-        }),
-        error
-      ));
-    });
-    child.on("close", (code) => {
-      const exitCode = code ?? -1;
-      if (exitCode === 0) {
-        finish(ok({ code: exitCode, stdout, stderr }));
-        return;
+    timer = globalThis.setTimeout(() => {
+      child.kill("SIGKILL");
+      child.unref();
+      finish(false);
+    }, timeoutMs);
+    child.once("error", () => finish(false));
+    child.once("close", (code) => finish(code === 0));
+  });
+}
+function spawnCommand(command, args, options) {
+  const job = process3.platform === "win32" ? windowsCommand(command, args) : void 0;
+  const child = spawn(job ? "powershell.exe" : command, job?.args ?? args, {
+    ...options,
+    env: job ? { ...options.env, ...job.env } : options.env,
+    windowsHide: true,
+    shell: false,
+    detached: !job
+  });
+  let exited = false;
+  child.once("exit", () => {
+    exited = true;
+  });
+  child.once("close", () => {
+    exited = true;
+  });
+  let termination;
+  const treeExited = async () => {
+    if (!child.pid)
+      return true;
+    if (job)
+      return exited && helper("powershell.exe", windowsJobProbe(job.name), 5e3);
+    return groupExited(child.pid);
+  };
+  const terminate = (timeoutMs) => {
+    termination ??= (async () => {
+      const deadline = performance.now() + timeoutMs;
+      let windowsKillConfirmed = !job || exited;
+      if (child.pid) {
+        if (job) {
+          if (!exited) {
+            windowsKillConfirmed = await helper("taskkill", ["/pid", String(child.pid), "/t", "/f"], Math.max(1, deadline - performance.now()));
+            child.kill("SIGKILL");
+          }
+        } else {
+          try {
+            process3.kill(-child.pid, "SIGKILL");
+          } catch {
+          }
+        }
       }
-      logger3.error("Command exited with non-zero code", {
-        command,
-        code: exitCode,
-        stderr: maskSecrets(stderr, options.secrets).slice(-500),
-        stdout: maskSecrets(stdout, options.secrets).slice(-3e3)
-      });
-      finish(err(
-        HaiDeployError.REMOTE_COMMAND_FAILED,
-        deployM("deploy_commandFailed", {
-          params: { command, error: maskSecrets(`${stdout.slice(-2500)}
-${stderr || `exit ${exitCode}`}`, options.secrets).slice(-3e3) }
-        })
-      ));
-    });
-    if (options.input !== void 0) {
-      child.stdin.write(options.input);
-      child.stdin.end();
-    } else {
-      child.stdin.end();
+      while (performance.now() < deadline) {
+        if (exited)
+          break;
+        await setTimeout$1(20);
+      }
+      let verified = false;
+      if (exited && job) {
+        verified = await helper("powershell.exe", windowsJobProbe(job.name), deadline - performance.now());
+        verified &&= windowsKillConfirmed || child.exitCode !== null;
+      } else if (exited) {
+        while (performance.now() < deadline) {
+          if (await treeExited()) {
+            verified = true;
+            break;
+          }
+          await setTimeout$1(20);
+        }
+      }
+      child.stdin.destroy();
+      child.stdout.destroy();
+      child.stderr.destroy();
+      if (!verified)
+        child.unref();
+      return verified ? "confirmed" : "unknown";
+    })();
+    return termination;
+  };
+  return { child, treeExited, terminate };
+}
+
+// src/container/deploy-secret-masker.ts
+function createSecretMasker(secrets = []) {
+  const values = [...new Set(secrets.filter(Boolean))].sort((a, b) => b.length - a.length);
+  if (values.reduce((total, value) => total + value.length, 0) > 1048576)
+    throw new RangeError("Secret redaction input is too large");
+  const pattern = values.length ? new RegExp(values.map((value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"), "g") : void 0;
+  const tailLength = Math.max(0, (values[0]?.length ?? 1) - 1);
+  let pending = "";
+  let ended = false;
+  function drain(final) {
+    let end = final ? pending.length : Math.max(0, pending.length - tailLength);
+    if (end > 0 && end < pending.length && /[\uD800-\uDBFF]/.test(pending[end - 1]) && /[\uDC00-\uDFFF]/.test(pending[end]))
+      end--;
+    if (end === 0)
+      return "";
+    let cursor = 0;
+    let output = "";
+    if (pattern) {
+      pattern.lastIndex = 0;
+      let match = pattern.exec(pending);
+      while (match && match.index < end) {
+        output += `${pending.slice(cursor, match.index)}***`;
+        cursor = pattern.lastIndex;
+        end = Math.max(end, cursor);
+        match = pattern.exec(pending);
+      }
+    }
+    output += pending.slice(cursor, end);
+    pending = pending.slice(end);
+    return output;
+  }
+  return {
+    write(text) {
+      if (ended)
+        throw new Error("Secret masker has ended");
+      pending += text;
+      return drain(false);
+    },
+    end() {
+      if (ended)
+        return "";
+      ended = true;
+      return drain(true);
     }
+  };
+}
+
+// src/container/deploy-command.ts
+var logger3 = core.logger.child({ module: "deploy", scope: "command" });
+function maskSecrets(text, secrets = []) {
+  const masker = createSecretMasker(secrets);
+  return masker.write(text) + masker.end();
+}
+async function runCommand(command, args, options = {}) {
+  const failure = (message, state) => err({
+    ...HaiDeployError.REMOTE_COMMAND_FAILED,
+    message: `${message}
+${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state.localTermination === "not-started" ? "deploy_localNotStarted" : "deploy_localUnknown")}`,
+    ext: { commandExecution: state }
   });
+  try {
+    return await new Promise((resolve6) => {
+      if (typeof command !== "string" || !command || command.includes("\0") || args.some((argument) => typeof argument !== "string" || argument.includes("\0")))
+        throw new TypeError("Invalid command arguments");
+      if (options.input !== void 0 && typeof options.input !== "string")
+        throw new TypeError("Invalid command input");
+      const maxCapture = options.maxCaptureChars ?? 1048576;
+      if (!Number.isSafeInteger(maxCapture) || maxCapture <= 0 || maxCapture > 16777216)
+        throw new RangeError("Invalid command capture limit");
+      const terminationTimeout = options.terminationTimeoutMs ?? 1e4;
+      if (!Number.isSafeInteger(terminationTimeout) || terminationTimeout <= 0 || terminationTimeout > 6e4)
+        throw new RangeError("Invalid command termination timeout");
+      if (options.timeoutMs !== void 0 && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0 || options.timeoutMs > 2147483647))
+        throw new RangeError("Invalid command timeout");
+      const secrets = [...options.secrets ?? []];
+      const safeCommand = maskSecrets(command, secrets);
+      const outputMasker = createSecretMasker(secrets);
+      const errorMasker = createSecretMasker(secrets);
+      const control = spawnCommand(command, args, { cwd: options.cwd, env: options.env ? { ...process3.env, ...options.env } : process3.env });
+      const child = control.child;
+      child.stdout.setEncoding("utf8");
+      child.stderr.setEncoding("utf8");
+      let stdout = "";
+      let stderr = "";
+      let stdoutTruncated = false;
+      let stderrTruncated = false;
+      let settled = false;
+      let interrupted = false;
+      let interruption;
+      let timer;
+      const finish = (result) => {
+        if (settled)
+          return;
+        settled = true;
+        if (timer)
+          clearTimeout(timer);
+        resolve6(result);
+      };
+      const interrupt = (reason, message) => {
+        interrupted = true;
+        interruption ??= (async () => {
+          if (timer)
+            clearTimeout(timer);
+          const localTermination = child.pid ? await control.terminate(terminationTimeout) : "not-started";
+          logger3.error("Command termination checked", { command: safeCommand, reason, localTermination });
+          finish(failure(message, { reason, localTermination }));
+        })();
+        return interruption;
+      };
+      const publish = async (text) => {
+        if (!text || settled || interrupted)
+          return;
+        stdoutTruncated ||= stdout.length + text.length > maxCapture;
+        stdout = (stdout + text).slice(-maxCapture);
+        try {
+          await options.onOutput?.(text);
+        } catch {
+          await interrupt("output", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandOutputFailed") } }));
+        }
+      };
+      const captureError = (text) => {
+        stderrTruncated ||= stderr.length + text.length > maxCapture;
+        stderr = (stderr + text).slice(-maxCapture);
+      };
+      if (options.timeoutMs && options.timeoutMs > 0) {
+        timer = setTimeout(() => {
+          logger3.error("Command timed out", { command: safeCommand, timeoutMs: options.timeoutMs });
+          void interrupt("timeout", deployM("deploy_commandTimeout", { params: { command: safeCommand } }));
+        }, options.timeoutMs);
+      }
+      const outputTask = (async () => {
+        try {
+          for await (const chunk of child.stdout) {
+            if (settled || interrupted)
+              return;
+            if (typeof chunk !== "string")
+              throw new TypeError("Command output must be UTF-8 decoded");
+            await publish(outputMasker.write(chunk));
+          }
+          if (!settled && !interrupted)
+            await publish(outputMasker.end());
+        } catch {
+          await interrupt("output", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandOutputFailed") } }));
+        }
+      })();
+      const errorTask = (async () => {
+        try {
+          for await (const chunk of child.stderr) {
+            if (settled || interrupted)
+              return;
+            if (typeof chunk !== "string")
+              throw new TypeError("Command error output must be UTF-8 decoded");
+            captureError(errorMasker.write(chunk));
+          }
+          if (!settled && !interrupted)
+            captureError(errorMasker.end());
+        } catch {
+          await interrupt("output", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandOutputFailed") } }));
+        }
+      })();
+      child.stdin.on("error", () => {
+        void interrupt("input", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandInputFailed") } }));
+      });
+      child.on("error", (error) => {
+        const safeError = maskSecrets(error.message, secrets);
+        logger3.error("Command failed to start", { command: safeCommand, error: safeError });
+        void interrupt("spawn", deployM("deploy_commandFailed", { params: { command: safeCommand, error: safeError } }));
+      });
+      child.on("close", async (code) => {
+        await Promise.all([outputTask, errorTask]);
+        if (settled || interrupted)
+          return;
+        if (timer)
+          clearTimeout(timer);
+        if (!await control.treeExited()) {
+          await interrupt("exit", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandTreeActive") } }));
+          return;
+        }
+        const exitCode = code ?? -1;
+        if (exitCode === 0) {
+          finish(ok({ code: exitCode, stdout, stderr, stdoutTruncated, stderrTruncated }));
+          return;
+        }
+        logger3.error("Command exited with non-zero code", { command: safeCommand, code: exitCode, stderr: maskSecrets(stderr, secrets).slice(-500), stdout: maskSecrets(stdout, secrets).slice(-3e3), stdoutTruncated, stderrTruncated });
+        finish(failure(deployM("deploy_commandFailed", { params: { command: safeCommand, error: maskSecrets(`${stdout.slice(-2500)}
+${stderr || `exit ${exitCode}`}`, secrets).slice(-3e3) } }), { reason: "exit", localTermination: "confirmed" }));
+      });
+      if (options.input !== void 0)
+        child.stdin.write(options.input);
+      child.stdin.end();
+    });
+  } catch {
+    return failure(deployM("deploy_commandFailed", { params: { command: "<command>", error: deployM("deploy_commandExecutionFailed") } }), { reason: "configuration", localTermination: "not-started" });
+  }
+}
+
+// src/container/deploy-target.ts
+function createTargetReader() {
+  return String.raw`function fail(message) {
+  print "Invalid deploy-target.json: " message > "/dev/stderr"
+  exit 2
+}
+function whitespace() {
+  while (substr(input, position, 1) ~ /^[ \t\r\n]$/) position++
+}
+function hexadecimal(text,    result, offset, digit) {
+  result = 0
+  if (length(text) != 4) fail("invalid Unicode escape")
+  for (offset = 1; offset <= 4; offset++) {
+    digit = index("0123456789abcdef", tolower(substr(text, offset, 1))) - 1
+    if (digit < 0) fail("invalid Unicode escape")
+    result = result * 16 + digit
+  }
+  return result
+}
+function utf8(code) {
+  if (code < 128) return sprintf("%c", code)
+  if (code < 2048) return sprintf("%c%c", 192 + int(code / 64), 128 + code % 64)
+  if (code < 65536) return sprintf("%c%c%c", 224 + int(code / 4096), 128 + int(code / 64) % 64, 128 + code % 64)
+  return sprintf("%c%c%c%c", 240 + int(code / 262144), 128 + int(code / 4096) % 64, 128 + int(code / 64) % 64, 128 + code % 64)
+}
+function string_value(    result, character, escaped, code, low) {
+  if (substr(input, position++, 1) != "\"") fail("expected string")
+  result = ""
+  while (position <= length(input)) {
+    character = substr(input, position++, 1)
+    if (character == "\"") return result
+    if (character ~ /[[:cntrl:]]/) fail("control character in string")
+    if (character != "\\") { result = result character; continue }
+    escaped = substr(input, position++, 1)
+    if (escaped == "\"" || escaped == "\\" || escaped == "/") result = result escaped
+    else if (escaped == "b") result = result sprintf("%c", 8)
+    else if (escaped == "f") result = result sprintf("%c", 12)
+    else if (escaped == "n") result = result "\n"
+    else if (escaped == "r") result = result "\r"
+    else if (escaped == "t") result = result "\t"
+    else if (escaped == "u") {
+      code = hexadecimal(substr(input, position, 4)); position += 4
+      if (code >= 55296 && code <= 56319) {
+        if (substr(input, position, 2) != "\\u") fail("missing low surrogate")
+        position += 2
+        low = hexadecimal(substr(input, position, 4)); position += 4
+        if (low < 56320 || low > 57343) fail("invalid low surrogate")
+        code = 65536 + (code - 55296) * 1024 + low - 56320
+      } else if (code >= 56320 && code <= 57343) fail("unexpected low surrogate")
+      if (code == 0) fail("NUL is not allowed")
+      result = result utf8(code)
+    } else fail("invalid escape")
+  }
+  fail("unterminated string")
+}
+function object_value(depth,    key, character, value, kind) {
+  if (depth > 16) fail("nesting is too deep")
+  position++
+  whitespace()
+  if (substr(input, position, 1) == "}") { position++; return }
+  while (position <= length(input)) {
+    whitespace(); key = string_value(); whitespace()
+    if (substr(input, position++, 1) != ":") fail("expected colon")
+    whitespace(); character = substr(input, position, 1)
+    if (character == "{") { object_value(depth + 1); value = ""; kind = "object" }
+    else if (character == "\"") { value = string_value(); kind = "string" }
+    else if (substr(input, position, 4) == "true") { value = "true"; kind = "boolean"; position += 4 }
+    else if (substr(input, position, 5) == "false") { value = "false"; kind = "boolean"; position += 5 }
+    else if (substr(input, position, 4) == "null") { value = ""; kind = "null"; position += 4 }
+    else if (match(substr(input, position), /^-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/)) {
+      value = substr(input, position, RLENGTH); position += RLENGTH; kind = "number"
+    } else fail("unsupported value")
+    if (depth == 1) {
+      if (key in values) fail("duplicate field: " key)
+      values[key] = value; kinds[key] = kind
+    }
+    whitespace(); character = substr(input, position++, 1)
+    if (character == "}") return
+    if (character != ",") fail("expected comma or closing brace")
+  }
+  fail("unterminated object")
+}
+{ input = input $0 "\n" }
+END {
+  position = 1
+  if (substr(input, 1, 3) == sprintf("%c%c%c", 239, 187, 191)) position = 4
+  whitespace()
+  if (substr(input, position, 1) != "{") fail("expected object")
+  object_value(1); whitespace()
+  if (position <= length(input)) fail("trailing content")
+  if (!(field in values) || kinds[field] == "null") { print fallback; exit }
+  if (kinds[field] != expected) fail("wrong type for " field)
+  if (values[field] ~ /[[:cntrl:]]/) fail("control character in " field)
+  print values[field]
+}
+`;
 }
 
 // src/container/deploy-scripts.ts
@@ -906,6 +1531,7 @@ previous=''
 restore=''
 changed=false
 locked=false
+interrupted=false
 started=$(date +%s)
 step_started=$started
 step() {
@@ -985,15 +1611,22 @@ finish() {
     outcome=passed
     if [ "$code" -ne 0 ]; then outcome=failed; fi
     printf '{"stage":"%s","status":"%s","durationSeconds":%s}\n' "$stage" "$outcome" "$(( $(date +%s) - step_started ))" >> "$root/steps-$id.jsonl"
-    printf '{"deploymentId":"%s","stage":"%s","exitCode":%s,"durationSeconds":%s}\n' "$id" "$stage" "$code" "$elapsed" > "$root/result-$id.json"
-    rmdir "$root/.deploy-lock" || true
+    # 先完整写入再同目录原子发布，SSH 重连核对不能读取到半份终态结果。
+    printf '{"deploymentId":"%s","stage":"%s","exitCode":%s,"durationSeconds":%s}\n' "$id" "$stage" "$code" "$elapsed" > "$root/result-$id.json.next"
+    mv "$root/result-$id.json.next" "$root/result-$id.json"
+    # 前台命令及同步恢复已结束；后台服务可继续运行，但不能使成功终态永久占锁。
+    # 中断时仍可能有活跃子命令，必须由全部描述符持有者退出后释放。
+    if [ "$interrupted" = false ]; then
+      flock -u 9
+      exec 9>&-
+    fi
   fi
   exit "$code"
 }
 trap finish EXIT
-trap 'exit 130' HUP INT TERM
+trap 'interrupted=true; exit 130' HUP INT TERM
 step preflight 'Checking deployment tools and package'
-for tool in sha256sum tar awk curl; do command -v "$tool" >/dev/null || { printf 'Required command missing: %s\n' "$tool" >&2; exit 1; }; done
+for tool in sha256sum tar awk curl flock; do command -v "$tool" >/dev/null || { printf 'Required command missing: %s\n' "$tool" >&2; exit 1; }; done
 if [ "$runtime" = auto ]; then
   if command -v podman >/dev/null 2>&1 && podman version >/dev/null 2>&1; then runtime=podman; else runtime=docker; fi
 fi
@@ -1001,7 +1634,20 @@ case "$runtime" in docker|podman) ;; *) printf 'Runtime must be docker or podman
 "$runtime" version >/dev/null
 "$runtime" compose version >/dev/null
 "$runtime" compose up --help | grep -q never || { printf 'Compose is too old. Install Docker Compose v2 or podman-compose 1.6.0 or newer (supports --pull never).\n' >&2; exit 1; }
-mkdir "$root/.deploy-lock" 2>/dev/null || { printf 'Another deployment is running. Check %s/.deploy-lock before retrying.\n' "$root" >&2; exit 1; }
+# 内核锁绑定同一文件描述符；绝不删除/替换锁文件，避免新 inode 绕过活跃部署。
+# 子命令继承 FD 9：即使父 shell 被强杀，仍执行的命令继续持锁；全部退出或重启后自动释放。
+exec 9>"$root/.deploy.lock"
+if flock -n 9; then
+  :
+else
+  lock_code=$?
+  if [ "$lock_code" -eq 1 ]; then
+    printf 'Another deployment is running. Wait for its commands to finish; do not remove %s/.deploy.lock.\n' "$root" >&2
+  else
+    printf 'Cannot acquire deployment lock (exit %s). Check filesystem flock support and permissions.\n' "$lock_code" >&2
+  fi
+  exit "$lock_code"
+fi
 locked=true
 cd "$source_dir"
 sha256sum -c SHA256SUMS
@@ -1093,70 +1739,129 @@ mv "$root/current.next" "$root/current"
 printf '[PASS] %s\n' "$id"
 `.replace(/@@([A-Z]+)@@/g, (_match, name) => values[name]);
 }
-function createUploadScripts(config, bundle, projectName) {
-  const ssh = config.ssh;
-  const host = ssh?.host ?? "SERVER_HOST";
-  const user = ssh?.username ?? "deploy";
-  const remote = `${config.remote.baseDir}/${projectName}`;
-  const port = ssh?.port ?? 22;
+function createUploadScripts() {
   const sh = String.raw`#!/bin/sh
 set -eu
-cd "$(dirname "$0")"
-host=@@HOST@@
-user=@@USER@@
-port=@@PORT@@
-remote=@@REMOTE@@
-bundle=@@BUNDLE@@
+source_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+cd "$source_dir/.."
+command -v awk >/dev/null || { printf 'Install POSIX awk to read deploy-target.json.\n' >&2; exit 1; }
+read_target() {
+  LC_ALL=C awk -v field="$1" -v expected="$2" -v fallback="$3" -f "$source_dir/read-target.awk" "$source_dir/deploy-target.json"
+}
+host=$(read_target host string SERVER_HOST)
+user=$(read_target username string deploy)
+port=$(read_target port number 22)
+remote=$(read_target directory string '')
+bundle=$(read_target bundle string '')
+identity=$(read_target identityFile string '')
+known_hosts=$(read_target knownHostsFile string '')
+strict=$(read_target strictHostKeyChecking boolean true)
+timeout=$(read_target connectTimeoutSeconds number 10)
 if [ "$#" -ge 1 ]; then host=$1; fi
 if [ "$#" -ge 2 ]; then port=$2; fi
 if [ "$#" -ge 3 ]; then user=$3; fi
-identity=$(printenv HAI_DEPLOY_IDENTITY_FILE || true)
-if [ -z "$identity" ]; then identity=@@IDENTITY@@; fi
+if value=$(printenv HAI_DEPLOY_IDENTITY_FILE) && [ -n "$value" ]; then identity=$value; fi
+if value=$(printenv HAI_DEPLOY_KNOWN_HOSTS_FILE) && [ -n "$value" ]; then known_hosts=$value; fi
+invalid_target() { printf 'Invalid deployment target. Edit deploy-target.json before running this script.\n' >&2; exit 1; }
 test "$host" != SERVER_HOST || { printf 'Specify the server: sh deploy.sh SERVER [PORT] [USER].\n' >&2; exit 1; }
+case "$host" in ''|*[!a-zA-Z0-9.:-]*|[!a-zA-Z0-9]*) invalid_target;; esac
+case "$user" in ''|*[!a-zA-Z0-9_-]*|[!a-zA-Z_]*) invalid_target;; esac
+case "$port" in ''|*[!0-9]*|???????????*) invalid_target;; esac
+test "$port" -ge 1 && test "$port" -le 65535 || invalid_target
+case "$timeout" in ''|*[!0-9]*|???????????*) invalid_target;; esac
+test "$timeout" -ge 1 && test "$timeout" -le 2147483647 || invalid_target
+case "$remote" in /*) ;; *) invalid_target;; esac
+case "$remote" in *[!a-zA-Z0-9/_.\ -]*|*/../*|*/..|/..) invalid_target;; esac
+case "$bundle" in *.tar) ;; *) invalid_target;; esac
+case "$bundle" in ''|*[!a-zA-Z0-9_.+-]*) invalid_target;; esac
+case "$strict" in true) strict=accept-new;; false) strict=no;; *) invalid_target;; esac
+test -f "./$bundle" || { printf 'Bundle missing: %s\n' "$bundle" >&2; exit 1; }
 for tool in ssh scp; do command -v "$tool" >/dev/null || { printf 'Install OpenSSH (%s).\n' "$tool" >&2; exit 1; }; done
-set -- -o BatchMode=yes -o StrictHostKeyChecking=@@STRICT@@ -o ConnectTimeout=10
-if [ -n "$identity" ]; then set -- "$@" -i "$identity"; fi
-known_hosts=@@KNOWN@@
-if value=$(printenv HAI_DEPLOY_KNOWN_HOSTS_FILE); then known_hosts=$value; fi
-if [ -n "$known_hosts" ]; then set -- "$@" -o "UserKnownHostsFile=$known_hosts"; fi
+set -- -o BatchMode=yes -o "StrictHostKeyChecking=$strict" -o "ConnectTimeout=$timeout"
+if [ -n "$identity" ]; then set -- "$@" -i "$identity" -o IdentitiesOnly=yes; fi
+if [ -n "$known_hosts" ]; then
+  known_hosts=$(printf '%s' "$known_hosts" | sed 's/[\\"]/\\&/g')
+  set -- "$@" -o "UserKnownHostsFile=\"$known_hosts\""
+fi
 printf '[1/3] Connecting to %s\n' "$host"
 ssh "$@" -p "$port" "$user@$host" "mkdir -p '$remote/incoming' && chmod 700 '$remote' '$remote/incoming'"
 printf '[2/3] Uploading %s\n' "$bundle"
 scp_host=$host
 case "$host" in *:*) scp_host="[$host]";; esac
-scp "$@" -P "$port" "$bundle" "$user@$scp_host:$remote/incoming/$bundle"
+scp "$@" -P "$port" "./$bundle" "$user@$scp_host:$remote/incoming/$bundle"
 printf '[3/3] Applying package and checking HTTP access\n'
-ssh "$@" -p "$port" "$user@$host" "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"
+if ssh "$@" -p "$port" "$user@$host" "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"; then
+  :
+else
+  code=$?
+  printf '[UNKNOWN] Remote execution may continue. Inspect %s/result-<deploymentId>.json (ID in manifest.json), current and containers before retrying.\n' "$remote" >&2
+  exit "$code"
+fi
 `;
   const ps1 = String.raw`param([string]$IdentityFile = $env:HAI_DEPLOY_IDENTITY_FILE)
 $ErrorActionPreference = 'Stop'
-Set-Location -LiteralPath $PSScriptRoot
-$target = Get-Content -LiteralPath './deploy-target.json' -Raw | ConvertFrom-Json
+Set-Location -LiteralPath (Split-Path -Parent $PSScriptRoot)
+$target = Get-Content -LiteralPath (Join-Path $PSScriptRoot 'deploy-target.json') -Raw -Encoding UTF8 | ConvertFrom-Json
 if ($target.host -eq 'SERVER_HOST') { throw 'Set the server host in deploy-target.json.' }
-if ($target.host -notmatch '^[a-zA-Z0-9][a-zA-Z0-9.:-]*$' -or $target.username -notmatch '^[a-zA-Z_][a-zA-Z0-9_-]*$' -or $target.directory -notmatch '^/[a-zA-Z0-9/_. -]+$' -or $target.directory -match '(^|/)\.\.(/|$)' -or $target.bundle -notmatch '^[a-zA-Z0-9_.+-]+\.tar$') { throw 'Invalid deployment target.' }
-$options = @('-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=accept-new', '-o', 'ConnectTimeout=10')
-if ($target.strictHostKeyChecking -eq $false) { $options[3] = 'StrictHostKeyChecking=no' }
+if ($target.host -isnot [string] -or $target.host -notmatch '^[a-zA-Z0-9][a-zA-Z0-9.:-]*$' -or $target.username -isnot [string] -or $target.username -notmatch '^[a-zA-Z_][a-zA-Z0-9_-]*$' -or $target.directory -isnot [string] -or $target.directory -notmatch '^/[a-zA-Z0-9/_. -]*$' -or $target.directory -match '(^|/)\.\.(/|$)' -or $target.bundle -isnot [string] -or $target.bundle -notmatch '^[a-zA-Z0-9_.+-]+\.tar$') { throw 'Invalid deployment target.' }
+$port = if ($null -eq $target.port) { 22 } else { $target.port }
+$timeout = if ($null -eq $target.connectTimeoutSeconds) { 10 } else { $target.connectTimeoutSeconds }
+if ($port -is [string] -or [string]$port -notmatch '^[0-9]+$' -or $port -lt 1 -or $port -gt 65535 -or $timeout -is [string] -or [string]$timeout -notmatch '^[0-9]+$' -or $timeout -lt 1 -or $timeout -gt 2147483647) { throw 'Invalid deployment port or timeout.' }
+if ($null -ne $target.strictHostKeyChecking -and $target.strictHostKeyChecking -isnot [bool]) { throw 'Invalid host key policy.' }
+if (($null -ne $target.identityFile -and $target.identityFile -isnot [string]) -or ($null -ne $target.knownHostsFile -and $target.knownHostsFile -isnot [string])) { throw 'Invalid SSH file path.' }
+$strict = if ($target.strictHostKeyChecking -eq $false) { 'no' } else { 'accept-new' }
+$options = @('-o', 'BatchMode=yes', '-o', "StrictHostKeyChecking=$strict", '-o', "ConnectTimeout=$timeout")
 if (-not $IdentityFile) { $IdentityFile = $target.identityFile }
-if ($IdentityFile) { $options += @('-i', $IdentityFile) }
-if ($target.knownHostsFile) { $options += @('-o', "UserKnownHostsFile=$($target.knownHostsFile)") }
+if ($IdentityFile) { $options += @('-i', $IdentityFile, '-o', 'IdentitiesOnly=yes') }
+$knownHosts = if ($env:HAI_DEPLOY_KNOWN_HOSTS_FILE) { $env:HAI_DEPLOY_KNOWN_HOSTS_FILE } else { $target.knownHostsFile }
+if ($knownHosts) {
+  $knownHosts = $knownHosts.Replace('\', '\\').Replace('"', '\"')
+  $options += @('-o', ('UserKnownHostsFile="' + $knownHosts + '"'))
+}
 $destination = "$($target.username)@$($target.host)"
 $scpDestination = if ($target.host.Contains(':')) { "$($target.username)@[$($target.host)]" } else { $destination }
 $remote = $target.directory
 $bundle = $target.bundle
+if (-not (Test-Path -LiteralPath "./$bundle" -PathType Leaf)) { throw "Bundle missing: $bundle" }
+function ConvertTo-NativeArgument([string]$Value) {
+  if ($Value.Length -gt 0 -and $Value -notmatch '[\s"]') { return $Value }
+  $escaped = [regex]::Replace($Value, '(\\*)"', '$1$1\"')
+  $escaped = [regex]::Replace($escaped, '(\\+)$', '$1$1')
+  return '"' + $escaped + '"'
+}
 function Invoke-Step([string]$Name, [string]$Command, [string[]]$Arguments) {
   Write-Host "[$Name]"
-  & $Command @Arguments
-  if ($LASTEXITCODE -ne 0) { throw "$Name failed (exit $LASTEXITCODE)." }
+  $nativeCommand = Get-Command $Command -ErrorAction Stop
+  if ($PSVersionTable.PSVersion.Major -lt 6 -and $nativeCommand.CommandType -eq 'Application') {
+    $start = New-Object System.Diagnostics.ProcessStartInfo
+    $start.FileName = $nativeCommand.Source
+    $start.WorkingDirectory = (Get-Location).ProviderPath
+    $start.UseShellExecute = $false
+    $start.CreateNoWindow = $true
+    $start.Arguments = ($Arguments | ForEach-Object { ConvertTo-NativeArgument $_ }) -join ' '
+    $child = [System.Diagnostics.Process]::Start($start)
+    try { $child.WaitForExit(); $code = $child.ExitCode } finally { $child.Dispose() }
+  } else {
+    & $Command @Arguments
+    $code = $LASTEXITCODE
+  }
+  $global:LASTEXITCODE = $code
+  if ($code -ne 0) { throw "$Name failed (exit $code)." }
 }
+$applying = $false
 try {
   foreach ($tool in @('ssh', 'scp')) { Get-Command $tool -ErrorAction Stop | Out-Null }
-  Invoke-Step '1/3 Connect' 'ssh' ($options + @('-p', [string]$target.port, $destination, "mkdir -p '$remote/incoming' && chmod 700 '$remote' '$remote/incoming'"))
-  Invoke-Step '2/3 Upload' 'scp' ($options + @('-P', [string]$target.port, $bundle, "$($scpDestination):$remote/incoming/$bundle"))
-  Invoke-Step '3/3 Apply and verify HTTP' 'ssh' ($options + @('-p', [string]$target.port, $destination, "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"))
-} catch { Write-Error $_; exit 1 }
+  Invoke-Step '1/3 Connect' 'ssh' ($options + @('-p', [string]$port, $destination, "mkdir -p '$remote/incoming' && chmod 700 '$remote' '$remote/incoming'"))
+  Invoke-Step '2/3 Upload' 'scp' ($options + @('-P', [string]$port, "./$bundle", "$($scpDestination):$remote/incoming/$bundle"))
+  $applying = $true
+  Invoke-Step '3/3 Apply and verify HTTP' 'ssh' ($options + @('-p', [string]$port, $destination, "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"))
+} catch {
+  if ($applying) { [Console]::Error.WriteLine("[UNKNOWN] Remote execution may continue. Inspect $remote/result-<deploymentId>.json (ID in manifest.json), current and containers before retrying.") }
+  Write-Error $_
+  exit 1
+}
 `;
-  const values = { HOST: shellArgument(host), USER: shellArgument(user), PORT: String(port), REMOTE: shellArgument(remote), BUNDLE: shellArgument(bundle), IDENTITY: shellArgument(ssh?.identityFile ?? ""), KNOWN: shellArgument(ssh?.knownHostsFile ?? ""), STRICT: ssh?.strictHostKeyChecking === false ? "no" : "accept-new" };
-  return { sh: sh.replace(/@@([A-Z]+)@@/g, (_match, name) => values[name]), ps1 };
+  return { sh, ps1, reader: createTargetReader() };
 }
 
 // src/container/deploy-bundle.ts
@@ -1247,7 +1952,8 @@ async function createDeploymentBundle(options) {
     if (selected.includes("storage-init"))
       put("initialize-storage", "");
     put("apply.sh", createApplyScript({ deploymentId: options.deploymentId, projectName, environment, directory: `${config.remote.baseDir}/${projectName}`, runtime: config.remote.runtime, partial: options.partial, selected: selected.filter((name) => name !== "storage-init"), hostPort: config.expose.hostPort, healthPaths: options.healthPaths }));
-    const instructions = deployM("deploy_bundleInstructions", { params: { file: basename(output), start: "apply.sh", images: [...references].join("\n"), compose: "compose.json" } });
+    const instructionParams = { file: basename(output), start: "apply.sh", images: [...references].join("\n"), compose: "compose.json" };
+    const instructions = deployM("deploy_bundleInstructions", { params: instructionParams });
     put("README.txt", `${deployM("deploy_bundleMetadata", { params: { version: artifact.appVersion, buildId: artifact.buildId, compose: "compose.json" } })}
 ${instructions}
 `);
@@ -1261,15 +1967,38 @@ ${instructions}
       throw new Error(tar.error.message);
     chmodSync(temporaryTar, 384);
     renameSync(temporaryTar, output);
-    const upload = createUploadScripts(config, basename(output), projectName);
+    const upload = createUploadScripts();
     const scripts = `${output.slice(0, -4)}-deploy`;
     mkdirSync(scripts, { recursive: true, mode: 448 });
-    writeFileSync(join(scripts, "deploy.sh"), upload.sh.replace('cd "$(dirname "$0")"', 'cd "$(dirname "$0")/.."'), { mode: 448 });
-    writeFileSync(join(scripts, "deploy.ps1"), upload.ps1.replace("Set-Location -LiteralPath $PSScriptRoot", "Set-Location -LiteralPath (Split-Path -Parent $PSScriptRoot)").replace("'./deploy-target.json'", "(Join-Path $PSScriptRoot 'deploy-target.json')"));
-    writeFileSync(join(scripts, "deploy-target.json"), `${JSON.stringify({ ...config.ssh, host: config.ssh?.host ?? "SERVER_HOST", username: config.ssh?.username ?? "deploy", port: config.ssh?.port ?? 22, directory: `${config.remote.baseDir}/${projectName}`, bundle: basename(output) }, null, 2)}
+    writeFileSync(join(scripts, "deploy.sh"), upload.sh, { mode: 448 });
+    writeFileSync(join(scripts, "deploy.ps1"), upload.ps1);
+    writeFileSync(join(scripts, "read-target.awk"), upload.reader);
+    const target = {
+      host: config.ssh?.host ?? "SERVER_HOST",
+      port: config.ssh?.port ?? 22,
+      username: config.ssh?.username ?? "deploy",
+      identityFile: config.ssh?.identityFile ?? "",
+      knownHostsFile: config.ssh?.knownHostsFile ?? "",
+      strictHostKeyChecking: config.ssh?.strictHostKeyChecking ?? true,
+      connectTimeoutSeconds: config.ssh?.connectTimeoutSeconds ?? 10,
+      directory: `${config.remote.baseDir}/${projectName}`,
+      bundle: basename(output)
+    };
+    const comments = {
+      host: deployM("deploy_targetHost"),
+      port: deployM("deploy_targetPort"),
+      username: deployM("deploy_targetUsername"),
+      identityFile: deployM("deploy_targetIdentityFile"),
+      knownHostsFile: deployM("deploy_targetKnownHostsFile"),
+      strictHostKeyChecking: deployM("deploy_targetStrictHostKeyChecking"),
+      connectTimeoutSeconds: deployM("deploy_targetConnectTimeoutSeconds"),
+      directory: deployM("deploy_targetDirectory"),
+      bundle: deployM("deploy_targetBundle")
+    };
+    writeFileSync(join(scripts, "deploy-target.json"), `${JSON.stringify({ ...target, _comments: comments }, null, 2)}
 `);
     writeFileSync(join(scripts, "README.txt"), instructions);
-    return { bundlePath: output, instructions: `${instructions}
+    return { bundlePath: output, instructions: `${deployM("deploy_bundleInstructions", { params: { ...instructionParams, file: output } })}
 ${scripts}`, startName: "apply.sh" };
   } finally {
     rmSync(staging, { recursive: true, force: true });
@@ -1633,6 +2362,7 @@ function generateWebProxyConfig(port, apiPrefix, webPort = 8080) {
   listen ${webPort};
   server_name _;
   root /usr/share/nginx/html;
+  large_client_header_buffers 4 32k;
   location / {
     try_files $uri $uri/ /index.html;
   }
@@ -1650,11 +2380,15 @@ function generateWebProxyConfig(port, apiPrefix, webPort = 8080) {
     proxy_set_header Host $http_host;
   }
   location ${apiPrefix.replace(/\/$/, "")}/ {
+    client_max_body_size 2129920;
     proxy_pass http://app:${port};
     proxy_http_version 1.1;
     proxy_set_header Host $http_host;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_request_buffering off;
     proxy_buffering off;
+    proxy_buffer_size 32k;
+    proxy_buffers 8 32k;
   }
 }
 `;
@@ -1679,8 +2413,10 @@ function buildConnectOptions(config) {
   const args = ["-o", "BatchMode=yes"];
   args.push("-o", `ConnectTimeout=${config.connectTimeoutSeconds}`);
   args.push("-o", `StrictHostKeyChecking=${config.strictHostKeyChecking ? "accept-new" : "no"}`);
-  if (config.knownHostsFile)
-    args.push("-o", `UserKnownHostsFile=${config.knownHostsFile}`);
+  if (config.knownHostsFile) {
+    const path = config.knownHostsFile.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
+    args.push("-o", `UserKnownHostsFile="${path}"`);
+  }
   if (config.identityFile) {
     args.push("-i", config.identityFile);
     args.push("-o", "IdentitiesOnly=yes");
@@ -1707,21 +2443,23 @@ function buildScpUploadArgs(config, localPath, remotePath) {
 }
 function createSshExecutor(config) {
   const exec = async (remoteCommand, options) => {
-    return runCommand("ssh", buildSshExecArgs(config, remoteCommand), {
+    const result = await runCommand("ssh", buildSshExecArgs(config, remoteCommand), {
       timeoutMs: options?.timeoutMs,
+      terminationTimeoutMs: options?.terminationTimeoutMs,
+      maxCaptureChars: options?.maxCaptureChars,
       secrets: options?.secrets,
       onOutput: options?.onOutput
     });
+    if (result.success)
+      return result;
+    const state = getDeployCommandState(result.error);
+    return err({ ...result.error, suggestion: deployM("deploy_remoteUnknown"), ext: { ...result.error.ext, commandExecution: { ...state, reason: state?.reason ?? "exit", localTermination: state?.localTermination ?? "unknown", remoteExecution: "unknown" } } });
   };
   const upload = async (localPath, remotePath) => {
     const args = buildScpUploadArgs(config, localPath, remotePath);
-    const result = await runCommand("scp", args, {});
+    const result = await runCommand("scp", args, { timeoutMs: 6e5 });
     if (!result.success) {
-      return err(
-        HaiDeployError.IMAGE_TRANSFER_FAILED,
-        deployM("deploy_imageTransferFailed", { params: { error: result.error.message } }),
-        result.error
-      );
+      return err({ ...HaiDeployError.IMAGE_TRANSFER_FAILED, message: deployM("deploy_imageTransferFailed", { params: { error: result.error.message } }), ext: result.error.ext });
     }
     return ok(void 0);
   };
@@ -1729,11 +2467,7 @@ function createSshExecutor(config) {
     logger4.debug("SSH preflight", { host: config.host, port: config.port });
     const result = await exec("true", { timeoutMs: 2e4 });
     if (!result.success) {
-      return err(
-        HaiDeployError.REMOTE_CONNECT_FAILED,
-        deployM("deploy_remoteConnectFailed", { params: { host: config.host, error: result.error.message } }),
-        result.error
-      );
+      return err({ ...HaiDeployError.REMOTE_CONNECT_FAILED, message: deployM("deploy_remoteConnectFailed", { params: { host: config.host, error: result.error.message } }), ext: result.error.ext });
     }
     return ok(void 0);
   };
@@ -1744,6 +2478,12 @@ function createSshExecutor(config) {
 var logger5 = core.logger.child({ module: "deploy", scope: "provider-docker-ssh" });
 var HEALTH_POLL_INTERVAL = 3e3;
 var HEALTH_MAX_ATTEMPTS = 40;
+var ServerResultSchema = z.object({
+  deploymentId: z.string(),
+  stage: z.enum(["preflight", "images", "dependencies", "start", "health", "complete"]),
+  exitCode: z.number().int().min(0).max(255),
+  durationSeconds: z.number().int().nonnegative()
+});
 function makeDeploymentId() {
   const now = /* @__PURE__ */ new Date();
   const pad = (n) => String(n).padStart(2, "0");
@@ -1791,7 +2531,7 @@ function createDockerSshProvider(config, container) {
     const { appDir, projectName, scan, provisionEnv, appEnv, options } = context;
     const deploymentId = makeDeploymentId();
     const hostPort = config.expose.hostPort;
-    const artifactDir = join(appDir, ".hai", "deploy", options?.environment ?? "prod");
+    const artifactDir = join(resolveProjectDirectory(appDir), ".hai", "deploy", options?.environment ?? "prod");
     mkdirSync(artifactDir, { recursive: true, mode: 448 });
     chmodSync(artifactDir, 448);
     const artifact = context.artifact;
@@ -1900,18 +2640,43 @@ function createDockerSshProvider(config, container) {
     const started = await ssh.exec(
       `mkdir -p ${shellArgument(`${remoteTar}.contents`)} && chmod 600 ${shellArgument(remoteTar)} && tar -xf ${shellArgument(remoteTar)} -C ${shellArgument(`${remoteTar}.contents`)} && sh ${shellArgument(`${remoteTar}.contents/${bundle.startName}`)} ${shellArgument(remoteDir)}`,
       { timeoutMs: 6e5, secrets: sidecar.secrets, onOutput: (output) => {
-        pendingOutput += output;
-        const lines = pendingOutput.split("\n");
-        pendingOutput = lines.pop() ?? "";
-        for (const line of lines) {
+        const parts = output.split("\n");
+        for (let index = 0; index < parts.length; index++) {
+          pendingOutput += parts[index].slice(0, 512 - pendingOutput.length);
+          if (index === parts.length - 1)
+            break;
+          const line = pendingOutput;
+          pendingOutput = "";
           const stage = /^\[(preflight|images|dependencies|start|health|complete)\]/.exec(line)?.[1];
           if (stage)
             options?.onProgress?.(stage);
         }
       } }
     );
-    if (!started.success)
-      return started;
+    if (!started.success) {
+      const resultFile = `${remoteDir}/result-${deploymentId}.json`;
+      const state = getDeployCommandState(started.error);
+      const checked = await ssh.exec(`if [ -f ${shellArgument(resultFile)} ]; then cat -- ${shellArgument(resultFile)}; fi`, { timeoutMs: 2e4, maxCaptureChars: 8192 });
+      let terminal;
+      if (checked.success && !checked.data.stdoutTruncated) {
+        try {
+          const parsed = ServerResultSchema.safeParse(JSON.parse(checked.data.stdout));
+          if (parsed.success && parsed.data.deploymentId === deploymentId)
+            terminal = parsed.data;
+        } catch {
+        }
+      }
+      return err({ ...started.error, message: `${started.error.message}
+${terminal ? deployM("deploy_remoteFinished", { params: { stage: terminal.stage, code: String(terminal.exitCode) } }) : deployM("deploy_remoteUnknown")}`, suggestion: terminal ? deployM("deploy_remoteFinished", { params: { stage: terminal.stage, code: String(terminal.exitCode) } }) : deployM("deploy_remoteUnknown"), ext: { ...started.error.ext, commandExecution: {
+        ...state,
+        reason: state?.reason ?? "exit",
+        localTermination: state?.localTermination ?? "unknown",
+        remoteExecution: terminal ? "finished" : "unknown",
+        deploymentId,
+        resultFile,
+        ...terminal ? { remoteExitCode: terminal.exitCode, remoteStage: terminal.stage } : {}
+      } } });
+    }
     logger5.info("Running health check", { url });
     const healthy = await healthCheck(`${url}${!hasWeb && scan.isSvelteKit ? "/" : "/health"}`) && (!hasWeb || await healthCheck(`${url}/_hai/web-health`) && await healthCheck(`${url}/`));
     if (!healthy) {
@@ -1936,9 +2701,14 @@ function createDockerSshProvider(config, container) {
     try {
       return await deploy2(context);
     } catch (error) {
-      logger5.error("Deployment bundle failed", { error });
       const reason = error instanceof Error ? error.message : String(error);
-      return err(HaiDeployError.DEPLOY_FAILED, deployM("deploy_bundleFailed", { params: { reason: maskSecrets(reason, Object.values(context.appEnv ?? {}).filter((value) => value.length > 6)) } }), error);
+      let safeReason = "Deployment bundle failed";
+      try {
+        safeReason = maskSecrets(reason, Object.values(context.appEnv ?? {}).filter(Boolean));
+      } catch {
+      }
+      logger5.error("Deployment bundle failed", { reason: safeReason });
+      return err(HaiDeployError.DEPLOY_FAILED, deployM("deploy_bundleFailed", { params: { reason: safeReason } }));
     }
   };
   return { name: "docker-ssh", deploy: deploySafely };
@@ -3064,13 +3834,15 @@ var DEPLOY_MIDDLEWARE = {
     { backend: "api", label: "HTTP notification API", purpose: "deploy_purposeEmail", fields: [required("url", "", "url"), field("method", "POST"), field("headers"), field("timeout", "10000", "number")] }
   ],
   sms: [
-    { backend: "aliyun-sms", label: "Aliyun SMS", purpose: "deploy_purposeSms", provisioner: "aliyun", fields: [required("accessKeyId"), { ...required("accessKeySecret"), secret: true }, required("signName"), field("endpoint", "dysmsapi.aliyuncs.com")] }
+    { backend: "console", label: "Console", purpose: "deploy_purposeConsole", fields: [] },
+    { backend: "aliyun-sms", label: "Aliyun SMS", purpose: "deploy_purposeSms", provisioner: "aliyun", fields: [required("accessKeyId"), { ...required("accessKeySecret"), secret: true }, required("signName"), field("endpoint", "dysmsapi.aliyuncs.com")] },
+    { backend: "api", label: "HTTP notification API", purpose: "deploy_purposeSms", fields: [required("url", "", "url"), field("method", "POST"), field("headers"), field("timeout", "10000", "number")] }
   ]
 };
 function describeMiddlewareBackend(backend) {
   return deployM(backend.purpose);
 }
 
-export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, deploy, describeMiddlewareBackend, getDeployRecovery, loadDeploymentConfig, loadDeploymentEnvironment, readDeploymentArtifact, saveDeploymentEnvironment };
+export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, deploy, describeMiddlewareBackend, getDeployCommandState, getDeployRecovery, loadDeploymentConfig, loadDeploymentEnvironment, readDeploymentArtifact, saveDeploymentEnvironment };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map